Attest → the story

One visit. Three accounts.
Nothing rewritten.

The Alvarez residence. A scheduled morning care visit — Maria Chen is the worker booked to do it. What follows is not a dramatization — every timestamp, count, and quoted sentence below was read out of the same signed pack you can download. Each link verifies its source in your browser, no install, nothing leaving the page.

attest: verified — the pack's own verdict, self-issued and re-checkable by anyone (hover the shield for the whole verdict line).

The plan

6:01 PM – 8:06 PM UTC · signed schedule
Morning care visit booked for Maria Chen — 90 minutes at the Alvarez residence. The schedule is an expectation: it tells the record what to watch for, never what happened.

What the house saw

The household's own devices — doorbell, contact sensor, camera — reported 9 events during the window; the remaining 1 entry is the worker's own self-report through her scoped link, signed like everything else (all times UTC):

Each entry carries its ingestion source (webhook = signed delivery; local_or_test = device snapshot, bytes attested by a signed sha-256 and withheld from this redacted pack; unknown = the worker's self-report — a person's claim, not a device's). Coverage: observed with events — the receipt bounds its own window (6:31 PM – 8:06 PM UTC) and signs 32% of it as polled, saying so in its own words: "Attest polled Ring Event History during this window; it attests what the pipeline observed, not what physically happened" — so silence where it occurs is watched silence, still never proof of absence.

The record closes — and says what it can't say

receipt rcpt_8af58f6242d04… · verify this receipt →
Door activity spans 65.25 minutes of the 90 scheduled — self reported, departure unconfirmed, identity never verified. The receipt self-labels its own limits:
Signed flags, straight from the payload:
  • departure_unconfirmed — Record closed for review; direction, identity, and continuous presence are not established
  • observed_interval_short — Observations span 65 min; 90 min scheduled. Time worked is unknown
signature_scope: record_integrity_only — the signature attests the record's integrity, nothing about physical truth.

The humans spoke — 4 statements, all signed, none edited

Then the humans disagreed. Every statement below appended to the same append-only review chain, verbatim, under its own signature. The record doesn't merge them, rank them, or pick a winner:

“I dispute this record — I arrived before the first observation shown.”

Maria Chen · via visit_review_link · Oct 9, 6:06 PM UTC · signed verbatim · verify inside the pack →
stated reason: Service or timing differed from the plan (worker-stated, never a verified cause)

“My mother was home all morning and says the doorbell never rang — nobody came to the door before ten.”

“I was home that afternoon � I heard the doorbell a little after six and saw someone at the door. I can't say how long she stayed.”

“I was home that afternoon; I heard the doorbell a little after six and saw someone at the door. I can't say how long she stayed. (Re-sending — my earlier message had a garbled character.)”

Household member · via family_link · Oct 10, 6:57 PM UTC · signed verbatim · verify inside the pack →
perception: saw_someone

Read them again: the household's account contradicts itself — first "nobody came," then "I heard the doorbell a little after six." That contradiction is the evidence. A system that normalized it away would be destroying the only thing the family actually has. And the pack carries doubt the same way: records signed inside a revoked key's suspect window stay annotated on the green stamp — never hidden, never rewritten.

Then somebody changed a number

A second copy of this pack exists with exactly one signed field rewritten: observed_span_minutes inflated 65.25 → 135.25 — past the 90-minute schedule. It still looks identical: same files, same story, same layout.

Open it in the verifier → FAILED: payload hash mismatch. Or compare the two packs — the page verifies each on its own merits, then names observed_span_minutes as the moved field and proves the transparency log only appended between exports. And this is the page a coordinator hands a mediator — attest diff --html renders the same comparison as an attachable report.

What this record never does. It doesn't say Maria Chen arrived at 6:31. It doesn't say she didn't. It says: the devices reported what they reported, the three accounts were given and signed, and none of it can be silently rewritten now. Who was at the door is still a human question — which is exactly what a dispute process is for.
Verify the whole pack → Forge a field yourself → The live record page → 2-minute tour →