Priority record (dated public evidence only)

This document does one thing: it timestamps, with dated public records, when proofbundle's core combination became public. That combination is signed (Ed25519) receipts, an external time anchor, and a typed relation/v0.1 lineage between receipts.

It makes no claim of being first, and no claim against any named third-party work. It is a list of facts with dates, nothing more. Priority, if it ever matters, is shown only through these public timestamps, never asserted in prose. This mirrors the standing related-work rule in RELATED_WORK.md.

Archival records (Zenodo)

• Software, all versions: concept DOI 10.5281/zenodo.21110642 (resolves to the latest software version; also in CITATION.cff).
• Technical Note, all versions: concept DOI 10.5281/zenodo.21230466.
• Technical Note 3.2.3: version DOI 10.5281/zenodo.21384526, published 16 July 2026.
• Technical Note 4.0.0: version DOI 10.5281/zenodo.22004295, published 19 August 2026. The deposited PDF has SHA-256 d46b6cf7fc21e96e1e9379ff983640873cdfa1700d4d0f69a5a8882b001c34db — the same file the concept DOI above now resolves to.

Public release history (GitHub tags and PyPI)

The GitHub release tags and the matching PyPI releases are the primary dated record. The milestones that carry the three parts of the core combination:

Date (UTC)	Tag	What became public
2026-07-01	v0.7.1	first public release of the receipt tool
2026-07-02	v1.0.0	signed (Ed25519) plus RFC 6962 Merkle receipt, verified offline
2026-07-03	v2.0.0b1	external time anchors, beta ([anchors]: RFC 3161, OpenTimestamps)
2026-07-09	v2.0.0	external time anchor layer out of beta
2026-07-10	v2.1.0	universal content root, decision receipts
2026-07-12	v3.0.0	anchor trust moved to the relying party (secure by default)
2026-07-16	v3.3.0	typed relation/v0.1 lineage between receipts (EXPERIMENTAL)

Full tag history is in the repository (git tag) and on the GitHub releases page; PyPI carries the matching release dates at pypi.org/project/proofbundle.

Standards engagement

• in-toto attestation issue #565 ("New predicate proposal: eval-result"), opened 3 July 2026: a public proposal for an in-toto eval-result predicate, referencing proofbundle as the MIT reference implementation.

• proofbundle issue #147 ("Common receipt envelope: interop with CSOAI inspect-receipts"), opened 19 August 2026, open as of 30 August 2026. The thread is the dated public record for the receipt-envelope requirements. Three of its entries carry measurements rather than proposals, each pinned to a commit hash:

  Date (UTC)	Entry	What became public
  2026-08-19	issue opened	the common-envelope requirement, stated
  2026-08-26	comment	counter-proofs for the schema-id, binding and key-resolution rules, measured against 397ae3ad
  2026-08-28	comment	a correction to our own earlier note: the 26 August canonicalisation pass reported "no finding" and had measured the wrong object

  The 28 August entry is in this record deliberately. A priority record that listed only the findings and not the retraction would be selecting its own evidence.

Not yet a public record. docs/RECEIPT_ENVELOPE_PROFILE.md (profile v0.1) and docs/SCITT_CPB_MAPPING.md were written on 30 August 2026 and are proposed, not adopted — they are in-repo documents, not released artifacts, and no row above rests on them. They become a dated public record when they are released, not when they are written. Anyone can resolve every row above today; that is the test this document applies to itself.

How to read this

Each row is a public, dated artifact anyone can resolve. The record establishes when something was published, not that it was published before anyone else, and not that the numbers inside any receipt are true. Those boundaries are the whole point of the project (THREAT_MODEL.md, docs/NON_CLAIMS.md).