Verifiable provenance for context a machine acts on. Three signed objects and one verification procedure, so that an output can be traced to the exact content behind it by someone with no access to your systems, no network, and no reason to trust you.
0.1 draft. The specification, reference implementation and test vectors publish shortly. This page runs the verification today, so the mechanism can be examined before the document exists.
Below is a real source record and a real Apodix receipt citing one passage of it. Your browser recomputes every digest with Web Crypto, rebuilds the Merkle tree, and checks the inclusion proof against the published root. Nothing is fetched and nothing is trusted.
Change a single character in the record, for example the figure 0.0412, and watch the content digest and the Merkle root diverge from what the witness signed. Restore it and the proof passes again. That is the whole mechanism, with nothing hidden behind it. If you can make it report success when it should not, see below.
What this demonstration does not prove, stated before you have to ask.
The values checked above are constants written into this page. Whoever serves a page controls its constants, so what you just watched is the mechanism working correctly, not evidence that anyone deserves your trust. A demonstration and a proof are different things, and a provenance project that blurs them has already lost the argument.
It is the same gap tier 1 has. An attestation is worth exactly the word of whoever produced it until something the operator cannot alter is involved. Real verification uses a receipt you were sent rather than one we wrote, signing keys from your own trust configuration rather than ours, and a log root held by someone with no stake in the answer.
Provenance does not imply accuracy. That sentence is normative in the specification, not a disclaimer beneath it. An implementation claiming otherwise is non-conformant.
Nothing is installed in the source system and nothing about it changes. The source file comes back byte for byte identical: Apodix adds nothing to the object it certifies. It signs a digest and files a statement in a log.
Reads at the point content leaves. Hashes it, signs a source assertion, never writes back.
Append-only transparency log. Its value is negative evidence: a quiet reissue becomes visible.
Verifies every item, drops the unattested, labels what passes with its tier, records what it withheld.
Binds one output to the exact context behind it. A stranger checks it offline, years later.
Segment boundaries depend on window size, overlap and tokenizer version, all of which change constantly. Signing passages would bind authenticity to an implementation detail, so every re-chunk would invalidate every signature although nothing about the source changed.
Apodix anchors provenance to content and treats a segmentation as a separately signed view of it. Re-chunking issues a new segmentation. The source statement is never reissued, and old receipts keep verifying.
| Segmentation | Method | Segments | Merkle root |
|---|---|---|---|
| A | fixed-window-256-overlap-32 | 4 | zjGHjqxtA_nN1B4ho-B40aVQPVwmoAByuhwOV_RkNY8 |
| B | fixed-window-192-overlap-0 | 5 | AQw5ea5d2xWmGz_vt0418atpXS1kTXIwrpTKUVqHNPk |
| One unchanged source statement covers both | PtIv8rWNxEMNMMaFh0hSgUvJvJuI5pfkcNsoLyb3Ghk | ||
Commit to what is stable, prove what is derived. A record of a million passages still needs about twenty digests to prove any one of them.
No valid statement. May pass by policy, but is labelled as what it is.
The operator's own witness. Worth the operator's word. Documentation.
A log the operator does not control. Survives "but you run this yourself". Evidence.
The source signs for itself, or a qualified seal applies. Legal weight, rare.
A document cannot state its own tier. The channel that carries trust is not one content can write to, which is why a crafted source arrives labelled tier 0 rather than arguing its way past the boundary.
None filed over anything published here, and publication permanently forecloses European patenting of it. Deliberate, and recorded in the governance document so it cannot be quietly reversed.
Lodvy Labs holds the name as a mark to hand to a neutral foundation, not to license. Governance moves once two independent implementations exist.
Tree heads mirror to an independent log from day one. If operation ever ceases, the full log is published as a static archive so every receipt stays verifiable.
Specification text CC BY 4.0, code Apache 2.0. The most useful contribution is an attack on the threat model: if a claimed defence does not hold, that is worth more than agreement about the rest.
The verifier above is the entire mechanism, running in your browser with nothing behind it. If you can make it report success over a record the witness never signed, or construct a case where an inclusion proof verifies for a passage that is not in the signed record, that is the most useful thing anyone could send.
The same goes for the design rather than the code. The threat model names eight attacks it defends against and seven it does not. If a claimed defence does not hold, saying so is worth more than agreement about everything else.