For physician reviewers — the receipts rail, accumulated

Your reviews end.
Your record shouldn't.

Every review a physician signs on the rail emits a tamper-evident receipt. One receipt is proof of one determination. Accumulated, they become something that has never existed in medicine: a portable, independently verifiable record of how you judge — volume, specialties, measured agreement — that belongs to you, not to a platform, an employer, or us. The reviews may be work for hire. The proof of your judgment is a career asset you keep.

One ledger entry — what each receipt holds

reviewed    sha256 of the artifact (the content itself — never stored, never ours)
verdict     affirmed · non-affirmed · modified
reviewer    credential class + specialty (NPI verified against CMS NPPES at signing)
signed      timestamp, anchored to the public registry
countersign registry root stamped into Bitcoin daily — today's root

What an accumulated ledger proves

Measured judgment, not asserted judgment

Test 3 of the published standard: sampled double-review with disclosed inter-reviewer agreement. Your ledger carries the number — the difference between "experienced reviewer" on a CV and a disagreement rate an auditor can inspect.

Specialty history with statutory weight

Colorado's 2026 law requires reviewers "competent in the relevant clinical area" from January 2027. A hash-anchored record of your specialty-matched reviews is that competence, provable — not claimed.

Proof that survives every platform

Each entry verifies at a public page against a registry countersigned into Bitcoin. Change employers, leave the network, outlive the company — your record still verifies. A credential that dies with its issuer was never yours.

A career asset from day one

Credentialing files, UM-director appointments, expert work, faculty standing — the places a verifiable review history matters. It starts accruing with your first signed review.

Start your ledger — join the review network The standard it's measured against Verify a receipt

The ledger itself

Not a description of a ledger — the ledger. Every fingerprint in the public registry, grouped by the day it first appeared in a published hash list, each day carrying the root that commits to it and the OpenTimestamps proof that stamped that root into Bitcoin. This page reads the same files /prove tells you to download; it is the recipe, rendered.

Fingerprints
Roots countersigned
With a public label
Under erratum
reading /roots/index.json …

An entry with no public label is not hidden — it is private by the anchorer’s choice, and still verifies for anyone holding the original document. Entries flagged erratum are covered by a published correction; the record is never rewritten. Hashes before 2026-08-20 predate the first published hash list, so they are shown as present on that date rather than given a first-appearance we cannot evidence.

Why we built it this way

The estate-wide thesis, applied to physicians: the people who do the work should own the asset the work creates. Platforms accumulate reviewer histories and keep them; when the reviewer leaves, the record stays behind. Here the ownership runs the other way by design — the registry is public, the proofs are independent, and the aggregated record is the physician's to carry, share at their own discretion, or keep private. We couldn't take it back if we wanted to. That's the point.

Where this stands today, honestly. Every element on this page functions now, per receipt: reviews emit anchored receipts, each verifiable at /verify, countersigned nightly. The ledger itself is live above — the whole registry, every fingerprint, rendered from the published files. What is not built is the per-reviewer view: your entries filtered to you, with your agreement statistics. That needs a reviewer cohort to be meaningful and it ships when there is one. Today the determinations in the registry come from a synthetic pilot — no BAA is executed anywhere in this estate, so no real patient record has been near it. No active-reviewer counts are claimed here because we publish coverage rather than claim it. Agreement statistics are shared exactly as widely as the physician chooses. And per the published standard's own honesty rule: a ledger proves accountability and consistency — it does not prove a reviewer is right.