Who will verify the record is genuine in a hundred years

A great-grandson opens a folder his family has carried across three house moves and two countries. In it is a letter, apparently written by a woman he never met, explaining a decision that split the family for a generation. The letter is clear, dated, and in a format that still opens. It changes how he understands his own name.

A cousin, reading the same file, asks the only question that matters: how do we know she wrote this? The folder has been through a dozen hands. Any of them could have corrected a sentence, removed a paragraph, or added a page that explains things a little too neatly. There is no way to tell. The letter survived. Whether it is her letter is now a matter of opinion.

This is the quieter failure that follows the loud ones. Most preservation work is about keeping bytes intact and formats readable, and that work is necessary. But a record is not only a thing that can be read. It is a claim that a particular person said a particular thing at a particular time, and a reader who cannot check that claim has an artefact, not a record.

The cause is that provenance is usually treated as context the reader will have. The people who made the record knew it was genuine, so they did not write that down in a way a stranger could test. A century later, there is no one left who knew.

Where trust leaks out

A copy is not a witness. Having the file does not tell you it is the same file. Without some fixed reference made at the time, every version that exists is equally plausible, and the one that survived is simply the one that survived.

Edits leave no mark. Digital material can be changed completely without any visible trace. Paper tears and fades in ways that show its history; a text file edited in 2070 looks exactly like one untouched since 2030.

The metadata lived somewhere else. Dates, authorship and the chain of custody were kept in a database, a service, a spreadsheet on somebody’s laptop. The content travelled; the proof did not. A file whose description was separated from it has lost the half that made it evidence.

The signature cannot be checked any more. A signature is only as useful as the means of verifying it. If the key, the method and the identity it was bound to are not themselves preserved in a readable form, the signature is a string of characters that once meant something.

All the copies came from one place. Several copies verified against each other mean something only if they were held independently. Three copies made last week from one altered original agree with each other perfectly.

The reader is expected to trust the holder. An archive that says “trust us, it is genuine” has made its credibility depend on an institution being present and honest in a hundred years. That is a wish, not a design.

What a record built for verification does differently

Fix the content at the moment of capture. A digest of each item, computed when it was made and written down, gives every future reader a reference to check against. It does not prove who made the item, but it does prove that what they are reading is what was there at the start.

Have the fixing witnessed. A reference held only by the archive proves little. The same reference deposited with people and places that have no interest in the content, at the time, is what lets a stranger later confirm that nothing moved after that date.

Keep the proof inside the record, in the same open format. The digest, the signature, the date, the account of who made the item and how it has been handled since, all stored alongside the content, described in plain language, readable with no tool that the content itself does not already need. If the proof requires a service to interpret, the proof dies with the service.

Write down what the proof means. A future reader should not have to know what a digest is to use one. The record should explain, in its own index, what each proof is, how to recompute it, and what a match does and does not establish.

Make the copies genuinely independent. Different holders, different places, different jurisdictions, each with its own history of custody, compared on a schedule and with the comparisons themselves recorded. Agreement between copies that could not have colluded is the closest thing to a witness that survives everyone.

What the reader still cannot know

Honesty requires saying where this stops. None of this proves that the person was telling the truth, or that they were not pressured, or that the selection of what went into the record was not itself a kind of editing. Provenance establishes that the record is what it was when it was made, and by whom, as far as the methods of the time allowed. It does not establish that the record is right. A reader in a hundred years deserves to be told that distinction rather than sold around it.

A test you can run today

Take one document you would want someone to believe after you are gone: a letter, a statement of why you made a decision, a recording. Write down, separately, everything a stranger would need to confirm it is yours and unchanged: when it was made, who could confirm that, what fixed reference exists, and where that reference is held.

Then imagine the file and the note travelling separately for fifty years, which is what usually happens. If the file on its own still carries enough to be checked, you have a record. If the checking depends on the note, on you, or on a service, what survives will be a text somebody may or may not choose to believe.

This is why provenance has to be designed in from the first item rather than added afterwards. It is the second half of a question whose first half is whether anyone can open the record at all, and both rest on the same principle as a record that has to survive its own context: everything needed to read it, and to believe it, travels with it. At EternalOS description and provenance are embedded next to the material in open formats, and copies are held by several holders and checked against each other; which verification methods will be used is being decided and documented now, not promised in advance.