Evidence log

Every board keeps an evidence log: a record of each web page the assistant opened, each screenshot it took, each file it downloaded and each page it saved to the Wayback Machine, with the time and a SHA-256 hash of the copy kept. The log is a hash chain, so if any capture or file is changed, removed or reordered afterwards, verification shows exactly which one.

Open it from Evidence in the status bar at the bottom of the window.

What is captured

Capture	When	What is kept
Page	The assistant opens a page in its browser or navigates to one (a click, a form submission, going back)	An MHTML copy of the page as it rendered: one file with the HTML, images and styles, which opens in any Chromium browser
Page read	The assistant reads a page without its browser: reading a URL, a web search that reads the top results, or an article added as a news feed	The HTML exactly as received. When the page came from archive.today or the Wayback Machine (paywalled or blocked sites), the entry says so and records the snapshot address
Screenshot	The assistant takes a screenshot	The PNG
Download	The assistant downloads a file, or a click starts a download	The file
Archive request	The assistant saves a page to the Wayback Machine	The archive link and time (the copy lives at the Internet Archive)

Each entry records the address, the page title, the capture time, the browser identity used, the DeepState version and the SHA-256 of each file. The same page captured again within a minute is not recorded twice. Pages over 50 MB are logged without keeping the file.

The tool results the assistant sees include the entry number and hash, so it can cite them.

Verifying

The evidence log checks itself each time you open it:

• every entry still has the hash it was given when it was recorded,
• every entry still follows the one before it (nothing removed, inserted or reordered),
• every file on disk still has the SHA-256 recorded at capture.

Intact means all three hold. Otherwise the log lists each problem, for example "#12: File changed since capture". The head hash, the hash of the last entry, pins the whole log: quote it in a report and anyone can later confirm the log hasn't changed since.

Files are stored read-only under the board's folder (boards/<board id>/evidence/<date>/), and the database refuses edits and deletes to log entries. Neither stops a determined person with access to your computer, which is why the hashes matter: changes can't be made undetectably.

On a node

A node whose source page was captured (a social post, an article, an embed, an identifier citing a source) shows a Captures section in its sheet, listing each capture with its hash and buttons to open the saved copy or show it in its folder.

In a dossier

When the pages a dossier cites were captured, the dossier gets an Evidence log appendix listing those captures (entry number, time in UTC, address and SHA-256), and the method section quotes the log's head hash and whether it verified at compilation.

Exporting for someone else

Export in the evidence log writes a zip that can be checked without DeepState:

• files/: every captured file
• SHA256SUMS: the hash recorded for each file. Check them with sha256sum -c SHA256SUMS (Linux) or shasum -a 256 -c SHA256SUMS (macOS)
• evidence-log.json and .csv: every entry in order, with its hashes
• verification.json: DeepState's check at the time of export
• how-entry-1-is-hashed.txt: a worked example showing exactly what is hashed, so the chain can be re-computed independently
• README.txt: the above, in plain words

Moving boards

The evidence log and its files travel inside .deepstate board exports and full backups, and stay verifiable after import, including when the board is imported under a new id. The log is not synced between collaborators: each person's captures stay in their own copy of the board.