{^} DocLock 1.5 & CLK-ATTEST-1: Offline Document Integrity with Dual-Authority RFC 3161 Attested Time (183/183 Checks)

{^} CORE OPERATING DIRECTIVE: Show first. Tell second. Let the numbers close the deal.

DocLock 1.5 is the offline document-integrity evidence tool from the 1.4 line — it seals a document’s actual file bytes, extracted text, and rendered form under SHA-256, character count, pixel count, and a QR trust capsule, then issues a graded verdict (Verified, Warning, Integrity Alert, Broken Seal) that anyone can recompute from the artifact alone with no server, account, or permission — with one decisive addition: CLK-ATTEST-1 attested time.

At sealing, CLK-ATTEST-1 fetches real RFC 3161 timestamp tokens from two independent authorities (FreeTSA and DigiCert) and submits the digest to OpenTimestamps, so a seal’s “when” is now traceable to UTC through attested sources with its uncertainty (down to ±1 second when the authorities agree) printed on the seal itself, reported as a separate time axis — ATTESTED, LOCAL-ONLY, or ATTESTATION-MISMATCH — that never inflates or rescues the integrity verdict. Every seal is still born LOCAL-ONLY and only genuine tokens upgrade it, verification of those tokens happens fully offline, older 1.2–1.4 records verify unchanged, the full suite passes 183 of 183 checks including live token acquisition, and the stated limits stay printed on the box: Roughtime isn’t implemented yet, the Bitcoin anchor is submitted-pending rather than complete, and browser-based sealing will often fall back honestly to LOCAL-ONLY — all in service of the same line as ever: DocLock proves a document is unchanged, not that what it says is true.

1. Three-Surface Offline Document Integrity (From the 1.4 Line)

Most document verification tools either lock only raw container bytes (failing when a PDF is legitimately printed or re-saved) or rely on a vendor cloud database that disappears or requires an account login to check. DocLock 1.5 binds three complementary evidence surfaces directly into a self-contained artifact and QR trust capsule:

• Surface 01 — Actual File Bytes (SHA-256): Cryptographic digest of the exact binary file payload. Any single-bit mutation in the container or metadata stream is immediately flagged.
• Surface 02 — Extracted Text & Deterministic Character Count: Canonical text extraction paired with exact character-count telemetry, allowing an auditor to distinguish container-level metadata changes from actual wording alterations.
• Surface 03 — Rendered Form, Pixel Count & QR Trust Capsule: Deterministic pixel-count telemetry of the visual page render alongside an embedded QR trust capsule so physical printouts and visual inspections remain bound to the cryptographic record.

From these three surfaces, the offline verifier computes a deterministic, four-tier graded integrity verdict — Verified, Warning, Integrity Alert, or Broken Seal — that anyone can recompute 100% offline from the artifact alone with zero server dependency, zero account registration, and zero vendor permission.

2. What’s New in DocLock 1.5: CLK-ATTEST-1 Attested Time

In Layers 02 (WHAT — DocLock) and 04 (WHEN — CryptoLock) of the Protocol One stack, local system clocks can drift or be rolled back by the machine that creates a seal. CLK-ATTEST-1 solves local-clock unreliability without sacrificing offline verification:

3. Orthogonal Integrity & Time Axes: Why Time Never Rescues a Bad Seal

A critical architectural invariant of DocLock 1.5 is that Integrity and Time are reported on two strictly orthogonal axes:

1. Integrity Axis: Verified · Warning · Integrity Alert · Broken Seal
2. Time Axis (CLK-ATTEST-1): ATTESTED · LOCAL-ONLY · ATTESTATION-MISMATCH

A valid dual-authority timestamp token never inflates or rescues a degraded integrity verdict (an altered file with a valid timestamp is still a Broken Seal), and an offline or browser-sealed document with no network path to TSA servers reports Verified integrity with an honest LOCAL-ONLY time axis rather than faking attestation.

• Full Backward Compatibility: Older DocLock 1.2–1.4 records verify unchanged without migration errors.
• Empirical Test Suite: The complete DocLock 1.5 verification suite passes 183 of 183 automated checks, including live RFC 3161 token acquisition from FreeTSA and DigiCert and full offline token verification.

4. Honest Stated Limits Printed on the Box

Guided by Protocol One’s core rule — “Show first. Tell second. Let the numbers close the deal” — DocLock 1.5 prints its exact operational boundaries right on the specification:

• Roughtime Not Implemented Yet: CLK-ATTEST-1 uses dual-authority RFC 3161 (FreeTSA + DigiCert) and OpenTimestamps submission; Google/IETF Roughtime is slated for a future revision.
• Bitcoin Anchor Is Submitted-Pending: At the moment of sealing, the OpenTimestamps calendar digest is submitted-pending rather than a finalized Bitcoin block confirmation.
• Browser-Based Sealing Falls Back Honestly to LOCAL-ONLY: Because browser CORS policies often block direct binary application/timestamp-query POSTs to external RFC 3161 endpoints, browser-only seals fall back transparently to LOCAL-ONLY unless sealed via the CLI/local engine.
• Core Invariant: “DocLock proves a document is unchanged, not that what it says is true.”

5. Deploy DocLock 1.5 & the Complete Protocol One Suite

• Deploy the Complete Protocol One Enterprise Bundle ($199 — Save $177): Includes all four specialized toolkits, wire-transfer & DocLock integrity SOPs, AI agent HITL governance templates, and the Executive Board Presentation Deck: https://protocolone.store/products/protocol-one-enterprise-bundle
• Deploy the Executive Deepfake Defense & Wire-Transfer Verification Playbook ($79): Operationalizes Tri-Signature + DocLock SHA-256 + CryptoLock / CLK-ATTEST-1 attested time for high-value treasury approvals: https://protocolone.store/products/executive-deepfake-defense-playbook

Launch Offer: Use code P1BUNDLE50 at checkout for $50 off the Complete Enterprise Bundle ($199 → $149), or P1LAUNCH20 for 20% off any individual toolkit.