# 0001 — The anchor is an interface, not a chain

**Status:** Accepted
**Supersedes:** the chain-selection conclusion in phase2-findings.md,
which answered *which chain* without asking *whether a chain*.

## Decision

Publishing an accumulator root is an **interface** with more than one implementation.

The default implementation is a **witnessed append-only transparency log**. Chain anchoring is
retained as a **periodic backstop** — the log's own checkpoints anchored daily rather than the
record's roots anchored hourly — and becomes the primary path only under the reversal conditions
below.

No part of `src/contubernium/` may depend on a chain client, an address format, or a fee model.

## What prompted this

phase2-findings.md measured anchoring cost and concluded that once
commitments are batched, every chain measured is affordable — so a rollup should be rejected
because it adds a dependency on its sequencer for a saving that no longer matters.

That argument does not stop at rollups. Applied one step further it asks the same question of the
chain: if cost is no longer deciding anything, what is the chain a dependency *for*?

## What the chain actually provides

architecture.md is precise about this, and the precision is what makes the
question answerable. A commitment establishes *that* a claim was made, *when* in the sequence, and
*who* is accountable. It does **not** establish that the claim is true — truth comes from
re-deriving the fragment from signed evidence, entirely off chain.

So the chain does three jobs, and two of them have well-established non-chain answers:

| Job | Non-chain alternative | Adequate? |
| --- | --- | --- |
| Prove a record existed before time *T* | Signed tree heads from a transparency log; RFC 3161 timestamping | Yes |
| Stop the operator quietly rewriting history | Append-only log with consistency proofs, checkpoints cosigned by independent witnesses | Yes |
| Slash stake automatically | Bond, escrow, contractual liability | **No** — this needs a chain to be automatic |

The precedents for the first two are not speculative. RFC 6962 Certificate Transparency secures the
entire web PKI this way; the Go module checksum database secures a language ecosystem; Sigstore's
Rekor secures software signing. All are Merkle trees with witnesses. None involve a blockchain.

## Why this is nearly free to do

The accumulator built in Phase 2 is not blockchain technology and never was. `accumulator.py`
imports `hashlib`, `dataclasses`, and two of our own modules. `commitment.py` treats `stake_ref` as
an opaque string, explicitly because what it resolves to is a property of the anchoring substrate
rather than of the record.

That was not luck. It follows from the rule that a commitment carries a digest and never a measured
value: once the anchored payload is 32 bytes with no semantics, where those bytes are published is a
separate decision from everything the protocol does. An inclusion proof against a root is valid
regardless of whether the root reached a chain, a log, or a newspaper.

## What was rejected, and why

**Chain as the primary anchor.** Rejected as a *default*, not as an option. It couples publication
availability to a chain's uptime, fee market, and governance, in exchange for a property — automatic
slashing — that nothing in Phase 2 yet uses. It also carries commercial friction that is real and
easy to underweight from inside an engineering document: for a utility, a data-centre operator, or
anyone inside FERC/NERC's orbit, "anchored to Ethereum" is frequently an objection to be handled
rather than a feature to be sold.

**Dropping chain anchoring entirely.** Rejected. A witnessed log's neutrality depends on the witness
set, which is a governance question with no answer yet. A daily chain checkpoint is a cheap hedge
against that question being answered badly, and it preserves the option of on-chain settlement
composability at Phase 4 without committing to it now.

**Choosing on cost.** Explicitly not the basis for this decision, and worth stating because cost is
what prompted the question. A witnessed log costs server time. Daily chain anchoring of the log's
checkpoints is **365 writes a year — about $257 at the worst fee observed in the sampled year, and
under a dollar at the cheapest.** Both are negligible. Cost decided between per-fragment and batched
anchoring; it does not decide between substrates, and a decision that claimed otherwise would be
using a measurement to justify a preference it did not support.

## What this costs us

Stated plainly, because a decision record that only lists advantages is advocacy.

**A transparency log detects tampering; it does not prevent it.** So does a chain — the difference
is who is watching. A chain has a standing incentivised validator set. A log needs monitors that
someone has to run and audit, and a log nobody audits is a database with extra steps. **This is an
operational obligation the design now carries**, and it should be named in the availability
obligation Phase 2 still owes.

**Witness selection is a trust decision we have deferred, not eliminated.** Who cosigns checkpoints,
and how a party outside the set gains confidence in them, is unresolved. A chain would have answered
this by not having to ask. **Since resolved** by
[decision 0003](0003-witness-policy-is-the-readers.md): the log does not declare its witnesses, the
reader declares whose cosignature it requires. What remains open is who *runs* monitors and under
what obligation.

**Permissionless participation is lost until the reversal conditions hold.** A witnessed log has an
operator, and an operator can exclude. That is acceptable while publishers are enrolled under a
legal relationship and unacceptable once they are not.

## What would reverse this

Concretely, so the trigger is recognisable rather than a matter of judgment:

1. **A counterparty requires stake to be slashed without a legal process.** This is the property a
   chain uniquely provides. If someone is paying for it, the chain becomes primary.
2. **Publishers must participate without a legal relationship to the operator.** Permissionless
   enrolment and a witnessed log with a gatekeeper are incompatible.
3. **A settlement contract must read commitments on chain** — the Phase 4 composability case.
4. **The witness-set question is answered badly**, or cannot be answered, such that a chain's
   validator set is genuinely more credible than the alternative.

Any one is sufficient. None of them hold today.

## Consequences for the work

- ~~An `Anchor` interface in the core, with a witnessed-log implementation behind it. It may not
  leak into `accumulator.py` or `commitment.py`.~~ Done: `anchor.py`. The shared tree shape moved
  to `merkle.py`, and the accumulator's vectors regenerated byte-identically across that refactor,
  which is the check that the two structures still agree on everything but their domains.
- ~~The wire specification gains the log's checkpoint format; the accumulator's format is
  unaffected, which is the point.~~ Done: [specification.md §10.5–10.8](../specification.md).
- ~~The Phase 2 exit criterion — "testnet operation with adversarial validators" — needs
  restating. Adversarial *validators* presumes a chain.~~ Restated in
  roadmap.md as adversarial *participants*, which is what it was reaching for and
  is demonstrable against either substrate.
- A chain implementation behind the same protocol. Not written: an untested chain writer would be
  worse than none, and the composite anchor already expresses the cadence it would run on.
- Evidence availability and log monitoring are the same obligation seen from two sides. They should
  be specified together rather than separately. **Still open.**