A standing check on the log, run from a separate machine. Every hour it re-derives what the log claims and compares it against what the log serves.
A tamper-evident log proves nothing on its own. The proof exists only when someone verifies it. The monitor is that someone, running on a schedule from a machine that does not host the log, reading the same public endpoints any outside party reads.
The signed checkpoint is verified against the log's published key. A checkpoint the log did not sign is rejected.
Each of the seven pinned witness cosignatures is verified against its published key. Fewer than four verified is an alert; a cosignature that fails to verify is its own alert. An eighth witness, gblin.digital, also cosigns. It is not in the signed trust-root manifest, so its cosignature is verified and reported but counts for nothing toward the four.
A consistency proof from the last head to the new one is checked from scratch. A rewrite, a fork, or a rollback fails here.
The records the log serves are hashed back into a tree, and the result must equal the signed head. A log that serves an altered or missing record under a valid-looking head fails this check.
Verified records are matched against watched keys. A watched key appearing in a record its owner did not make is the earliest signal of a compromised key.
A frozen but valid-looking checkpoint, or a stale cached view, is caught by the age of the newest witness cosignature.
The witnesses check the log at the moment it writes; they refuse to cosign a fork. The monitor checks what the log later serves to readers, which the witnesses never see. The two cover different sides of the same log. The monitor advances its trusted head only past a checkpoint that is signed, cosigned, consistent, and whose records reproduce the head, and it stops loudly rather than drift when any of those fail.
Every signature on the checkpoint is verified: the log's Ed25519 and ML-DSA-44 signatures, the seven pinned Ed25519 witness cosignatures, and the two independent ML-DSA-44 cosignatures. The quorum is counted over the Ed25519 cosignatures alone. A post-quantum cosignature that failed would alert, but a valid one cannot stand in for a missing fourth witness.
Two copies run. One is on a different machine from the log at the same hosting provider. The second is on separately owned hardware on a different network, so a single provider cannot take both down or serve both the same false view. Both are operated by us. A copy run by an unrelated party is the stronger version, and the same checks are reproducible against the public endpoints by anyone.
A watched record matched means the bytes matched. It says nothing about whether the record's content is true.
Nothing the monitor reads is private. The checkpoint, the witness cosignatures, the consistency and inclusion proofs, and the record bytes are all served openly, and the log is also published as static tiles you can mirror and recompute from end to end.