Audit chain

Every rating event, hashed and chained.

Every result that moves a Crest writes one row to an append-only log. A cron rolls those rows up into a Merkle tree, hashes the root against the prior anchor, and posts the chained hash to a public, independently-hosted GitHub repository BuiltByGo/trustpadel-audit-chain. Each release attaches an OpenTimestamps proof that pins the chained hash to the Bitcoin blockchain. Once a hash is on Bitcoin, it cannot be backdated — by us or anyone else.

Latest anchor

Chained hash

5de6f1296ad318c0fee9f4b30fe7347b5db416915a09eebfdf44ff3c8f9f8029

Anchored at

Aug 31, 2026, 12:30 AM UTC

1 events · last from Aug 28, 2026, 11:00 AM UTC

Externalised

https://github.com/BuiltByGo/trustpadel-audit-chain/releases/tag/anchor-2026-08-31

The release attaches a chained_hash.ots OpenTimestamps proof that pins this hash to the Bitcoin blockchain — once that proof confirms, the timestamp is impossible to backdate. Verify locally:

gh release download anchor-2026-08-31 \
  --repo BuiltByGo/trustpadel-audit-chain \
  -p chained_hash.ots
ots verify chained_hash.ots

Chain history

Aug 31, 2026, 12:30 AM UTC
ON GITHUB ↗
1 event
Merkle root
b8317659555b63a2f1734401229857293dbf38ef2f2ce358b8ad9184c7e112bf
Chained hash
5de6f1296ad318c0fee9f4b30fe7347b5db416915a09eebfdf44ff3c8f9f8029
← prior —

How to verify

Take an independent copy of the rating_event rows covered by the anchor (first_event_at → last_event_at).
Order them by (occurred_at ASC, id ASC). Canonicalise each row with pipe-separated fields in this order: id, player_id, discipline_id, match_id, occurred_at (ISO), mu_before, sigma_before, mu_after, sigma_after, crest_before, crest_after, source, version.
Hash each row with SHA-256 → leaves. Build a Merkle tree (pair-hash bottom up, odd leaves duplicate). Compare the root to merkle_root.
Compute sha256(prior_chain | merkle_root | anchored_at). Compare to chained_hash.

Reference implementation: apps/trustpadel/lib/audit-anchor.ts.

Questions about how this chain plugs into commercial-grade licensing? Get in touch →