The evidence
Every record behind every figure is fingerprinted, and every fingerprint is timestamped by two independent services, when it is made and before anything is published. So anyone shown a record later can check that it existed then and has not changed since.
- The fingerprints, with their timestamp proofs beside them
- The assessments: every provider tested each day, what it was charged, and why any was excluded
- The timestamp authority's certificates, kept so that a proof can be checked even if the service goes
The rest of this page is the public repository's own explanation, as it stands in its README; "here" in it means the repository.
Raw files and fingerprints
The raw files, meaning the census, the probe's listing snapshots and test records, and the rehearsals, are OpenRouter's responses. They are kept in a private repository and are not published here. The same holds for the GPU-hour price readings taken twice a day since October 2026 for the derived series, which are GPU clouds' responses; their sources are listed in gpu_sources.json. It holds too for the market data read once a day since October 2026 from OpenRouter's Data API, listed in market_sources.json: the data is licensed under CC BY 4.0, but is kept privately like the census, and figures derived from it are published with OpenRouter's citation.
Each day's raw files are fingerprinted with SHA-256, and the fingerprints are published in data/hashes/, one file per day, in the format of sha256sum. A fingerprint file is written once. Anyone later shown a raw file can check, with sha256sum -c from the repository root, that it has not changed since its fingerprint was published.
Each assessment is fingerprinted the same way when it is made, one fingerprint per file, in data/hashes/assessments/, and timestamped before it is published. From the first publication, 3 November 2026, the assessments themselves are published in data/assessments/, those of the shadow period with them, each later day once its page is built. A day on which publication was suspended (CONTINUITY.md) is never published; its fingerprint is.
Timestamps. Each fingerprint file is timestamped, when it is written, by two independent services: OpenTimestamps, which anchors it in the Bitcoin blockchain within a few hours, and FreeTSA, a timestamp authority that signs it within seconds under RFC 3161. The two proofs lie beside it, as NAME.sha256.ots and NAME.sha256.tsr. Only the fingerprint is sent to either service, never the records. FreeTSA's certificates are kept in data/stamps/certs/. Fingerprints already published when stamping began were stamped then; the moment is recorded in data/hashes/stamping-began.txt, and their proofs show existence from it.
Everything else is kept here and updated automatically from the private repository.
How to check a fingerprint and its timestamps
First, check a record against its fingerprint. From the repository's root, sha256sum -c data/hashes/probes/2026-10-20.sha256 checks every file the fingerprint lists. It needs the records themselves, which are private; anyone later shown a record can run it.
Then, when the fingerprint existed: OpenTimestamps. Download the fingerprint file and its .ots proof. Open https://opentimestamps.org in any browser and drop both files on the page. It names the Bitcoin block that holds the stamp, and that block's time. A proof less than a few hours old shows as pending. With a Bitcoin node, ots verify NAME.sha256.ots gives the same answer.
And the signed time: RFC 3161. With OpenSSL, from the repository's root:
openssl ts -verify -data data/hashes/probes/2026-10-20.sha256 -in data/hashes/probes/2026-10-20.sha256.tsr -CAfile data/stamps/certs/cacert.pem -untrusted data/stamps/certs/tsa.crtIt prints Verification: OK. OpenSSL may also warn that tsa.crt is not a CA certificate. That is expected: it is FreeTSA's signing certificate, passed with -untrusted, not the authority that vouches for it, which is cacert.pem. To see the time it records:
openssl ts -reply -in data/hashes/probes/2026-10-20.sha256.tsr -text