Append-only, public, unauthenticated
Every receipt this service issues has its digest appended here. The structure is what makes it append-only, not our word: an operator who rewrote or removed an entry could not produce a consistency proof between the root they published before and the one they publish after.
Digests only, never receipts. Publishing the receipts themselves would expose which workspaces are active and against what — which is customer information, not transparency.