SSM-Clock Stamp – Observed-time Mode (1.7)

Purpose. Optionally set iso_utc from lightweight observed time sources while keeping the same one-line stamp. Core verification remains anchored to iso_utc; evidence is additive.

Goal (in one line). Opportunistic timestamping with evidence: kv:time_mode=observed, plus a tiny ASCII sidecar that records sources and checks.

Minimal procedure (producer)

  1. Observe time from k >= 1 sources (e.g., OS clock, HTTPS Date, org NTP, GPS).
    • Compute: t_obs = median(t_1, ..., t_k)
    • delta_sec = abs( unix(t_local) - unix(t_obs) )
    • If delta_sec > tolerance_sec, prefer t_obs.
  2. Set the stamp time
    • iso_utc = format_Z(t_obs) (YYYY-MM-DDThh:mm:ssZ, no subseconds)
    • Else keep iso_utc = format_Z(t_local) and carry obs_iso_utc = format_Z(t_obs) in evidence.
    • Add kv:time_mode=observed in the stamp tail (optional but recommended).
  3. Keep ASCII evidence (sidecar, not part of the stamp)
    • obs_iso_utc=<ISO_Z>
    • tolerance_sec=<int>
    • delta_sec=<int>
    • obs_sources_ascii=<comma-or-pipe list>
    • obs_evidence_sha256 = sha256( ascii(concat_of_sources_and_reported_times) )
      where concat_of_sources_and_reported_times is newline-joined ASCII records source_label "|" iso_z, e.g.:
      OS|2025-10-14T04:59:03Z
      HTTPS_Date|2025-10-14T04:59:03Z
  4. Publish anchors as usual (optional but recommended)
    • Daily roll-up: rollup_D = sha256( ascii(Stamp_1 "|" ... "|" Stamp_n) ) using canonical sort (iso_utc, stamp_core, chain).

Core math stays unchanged (recap)
wrap360(x) = x - 360*floor(x/360)
theta_deg = wrap360( (unix_seconds / 86400) * 360 )
rasi_idx = floor(theta_deg / 30)
chain_k = sha256( ascii(chain_{k-1} + "|" + stamp_core_k) ) with chain_0 = "0"*64

Verifier guidance (acceptance checks)

  • Delta bound: delta_sec' = abs( unix(iso_utc) - unix(obs_iso_utc) ) <= tolerance_sec.
  • Delta consistency: recorded delta_sec ≈ delta_sec' (within 1 s).
  • Evidence hash: rebuild concat_of_sources_and_reported_times (normalize to LF) → verify obs_evidence_sha256.
  • Outcome flag: EVIDENCE_OK=true iff all evidence checks pass; absence of evidence is acceptable unless policy requires it.
  • Anchor still rules: public “no-later-than” comes from published rollup_D.

Security notes (practical)

  • Median over multiple sources reduces drift and single-source tampering.
  • Evidence is advisory. It improves trust in iso_utc selection but does not change the stamp math.
  • Leap second: 23:59:60 remains invalid even in observed mode.

Navigation
Back: SSM-Clock Stamp – Time Semantics & Anchors (1.6)
Next: SSM-Clock Stamp – Additive Key–Value Tail (1.8)