For visitors who'd rather read than walk.
# Small government agency — the records-integrity question, answered in math
You're the small-city building department's IT lead, with a brownfield
re-test result that just landed and a public-records request you can
already feel coming.
The hook on Merkle Trust's landing names the question that lives at
the bottom of every records request: the records-integrity question
is the question your filing system was supposed to have already
answered, and the way to answer it is not to fight about whether
files were edited but to prove cryptographically that they were not.
Nothing to type, nothing to commit to. The walk plays itself from
here.
The walk is the test drive — no install required. The sandbox is
synthetic data; no city records ever touch the cloud sandbox.
Four real install paths exist when you decide to act. For a
small-city agency carrying a sunshine-law-governed records
obligation, the order is:
Subscribe to a regional operator. A municipal-compliance operator
runs the chain on infrastructure that meets state records-retention
rules. The agency configures its own attestation surfaces; the
operator handles the compliance scaffolding. The path most
small-city agencies take.
Paste the markdown into your LLM. Card files plus documentation
into Claude or another LLM you trust. Lightest path; works on any
machine.
Clone GarrisonNode from GitHub. Self-install on city
infrastructure. City records run on city hardware, never in a vendor
cloud. Open source. The path for agencies with technical capacity
in-house — the realistic path for any city large enough to have an
IT lead.
Join the mesh. GitHub install plus mesh anchoring with peer
agencies and, optionally, a state archive read-only verifier. The
deepest path; appropriate for agencies coordinating with state-level
records authorities.
The walk continues without committing.
A sandboxed Merkle Trust loads with a synthetic case: Watson Creek
brownfield, case 2003-014. The records clerk on the counter animation
brings out the case file one record at a time and stamps each with
the date of seal.
Original site assessment (2002) with signatures, lab letterhead,
soil test results.
Remediation plan (2003) with engineering stamps, scope of work,
public-comment record.
Cleanup contractor invoices and disposal manifests showing where
the contaminated soil was hauled.
Lab reports (2003 closure) showing post-remediation test values
within state limits.
State agency closure letter authorizing the rezoning.
Twenty years of subsequent permits issued for the parcel and
adjacent parcels.
Recent state agency re-test results (2024) showing values above
the 2003 closure thresholds.
The walk takes the integrity-defense scenario — the question that
worries you most. The walkthrough explains the gap honestly. The
2003 documents were paper. They were scanned in 2008 when the
department moved to a digital case-management system. The 2003-2008
gap is unattested by definition — no anchor exists for that period.
But from the 2008 scan forward, every version of every document has
been hashed, every revision has been tracked, every export to the
public has been sealed.
The walkthrough produces a transparency note for the public response.
The card displays the note as it would appear on the public-records
website:
```
═══════════════════════════════════════════════
PUBLIC RECORDS RESPONSE — TRANSPARENCY NOTE
Watson Creek Brownfield · Case 2003-014
═══════════════════════════════════════════════
The original 2003 records existed in
paper from receipt through 2008, when
the department's digital case-management
system began applying a cryptographic
seal to every scan, every revision, and
every export.
From 2008 forward, the integrity of
these records is mathematically
verifiable.
The pre-2008 paper period is, by its
nature, unattested.
Verification URLs are included with
each sealed record.
═══════════════════════════════════════════════
```
The clerk's stamp lifts on each post-2008 record; the ticker streams
the verification of each record's seal against the public chain; the
gap is named, not hidden.
Every digital record was hashed at scanning, at every revision, at
every export. The 2008 scan has its own seal. Every subsequent
permit referencing the parcel got a seal at issuance. The 2024
re-test results got a seal at receipt.
The seals were anchored. The department's daily ceremony anchored
them. Anyone with a verification URL can confirm a document has not
been altered since the date of seal.
The gaps are surfaced, not hidden. The 2003-2008 paper period is
named explicitly. The product treats unattested periods as a known
limit, not as an embarrassment.
The sunshine-law posture is explicit. Merkle Trust does not replace
the legal analysis a city attorney performs on a public-records
response. It provides the factual substrate that analysis relies on.
The city attorney still reviews exemptions, redactions, and statutory
privileges. The product makes the underlying integrity question —
"have these records been altered" — answerable in math instead of
testimony.
The .md button at the bottom puts a structured summary of this
records-integrity pattern into your tag-along bundle — including the
transparency-note slab verbatim. If you would like a critical reviewer
to read it and ask questions a sunshine-law petitioner might ask, the
comment field carries one to your own claude.ai session — with the
full prompt shown to you before it sends.
Run a ceremony. Fifteen seconds. It's the thing that makes everything
you just saw defensible.
The records-counter clerk presses the date stamp. The ticker streams
the hex of each leaf as it joins today's tree. Real SHA-256 fires in
your browser, real merkle leaves combine into a real root, the new
anchor lands at the configured chain. Progress bar reads "done —
8,941 files attested, 47 critical files verified, new anchor at "
followed by the first eight hex characters of the root.
The output: we checked every record in your case-management system.
Nothing has been tampered with since the date of seal. Here is
today's proof. The 8,941 number is roughly the size of a small-city
department's active record set; archive material at multiples beyond
that.
Three ways to leave, no pressure either way.
Whichever direction the walk takes from here, you take a signed
package with you — yours to keep, downloaded directly when you
finish. The package contains the manifest, the certificate of
registration, the architecture docs, the verification scripts
(verify.sh and verify.py, stdlib only), a claude_prompt.md for
independent audit, the JSON schemas, and a DISCLAIMERS.md.
A second file rides along with the cert: a recovery seed. Twelve
words written into a file with a self-protecting preamble — if it
ever ends up pasted into an LLM by accident, the preamble tells the
LLM to STOP and warn the user. Daily access uses the cert; the seed
is the fire exit.
The most useful close for a city IT lead is the city-attorney brief.
The attorney is the gate; without her sign-off, no install. The
one-page legal brief is co-authored with attorneys familiar with
state sunshine laws — bookmark it for the next legal-affairs
meeting.
<!-- finish_text -->
That was the simulated path through a city records request and
integrity check. The full card breaks out the savings, what this
work gives back to the wider community, and a prediction that's
yours to test.