Goblin House — Corpus Merkle root, 2026-09-28

How to verify this attestation

1. Pull every source receipt for id in [1..70,858]:

   for id in 1..70858; do
     curl -s https://www.goblinhouse.net/source/$id/receipt.json | jq -r '.custody.contentHash // empty'
   done > leaves.txt

2. Compute the Merkle root over the resulting hex hashes — sorted ascending by source.id, hashed as raw hex strings (no decoding), Bitcoin-style odd-level duplication. Reference implementation:

   function pairHash(l, r) { return sha256(l + r) }
   function root(level) {
     while (level.length > 1) {
       const next = []
       for (let i = 0; i < level.length; i += 2)
         next.push(pairHash(level[i], level[i + 1] ?? level[i]))
       level = next
     }
     return level[0]
   }

3. Compare the computed root to 5387cf4492ba36884c4c4fbf… above. If they match, the corpus on 2026-09-28 contained exactly the documents whose hashes you fetched. If they don't, one or more documents have been altered, removed, or added since the attestation was published.

The signature is a server-side HMAC — it prevents one curator from silently swapping the row, but it does NOT prove third-party-verifiable integrity (we hold the key). For that, future versions will swap to an asymmetric signature with a publicly-pinned verification key.

Machine-readable: JSON