This page reads the Stellar ledger directly from your browser and compares it against the figures the cooperative publishes. Open your developer tools and watch: the chain data comes from Horizon, not from us. We cannot change what it says on its way to you.
Eleven record fingerprints in our database could not be re-derived. Running our own code against the stored record and its stored salt did not reproduce the stored hash. All eleven had already been swept into an anchor.
The anchors are not wrong — they commit to the hashes they were given. What is broken is the link from an anchored hash back to the record it fingerprints. If one of those records was yours and you derived its hash here, you would have been told the result appears in no anchor at all. This cooperative made you a promise — your record is anchored and you can check it yourself — that it could not keep for that record.
We found no evidence that any record was altered, and we are not claiming any was. The cause was a defect in code that has since been replaced and can no longer be inspected, which means we cannot tell you what those fingerprints described. We are not going to guess in a permanent record. The affected records were recomputed as they stood and re-anchored; the earlier anchors are untouched. They verify from that point forward.
The full account — including which records, by identifier — is itself a fingerprinted, anchored governance record, so this disclosure is held to the same standard as everything else here.
That disclosure was itself wrong in one particular, and a second record says so. It listed twelve records; one of them — this cooperative’s own community pool, not a person — was included in error. The pool is fingerprinted by a different part of the system under a shape we knew about all along, so describing it as unexplained was false, and treating it as unexplained caused its fingerprint to be overwritten. It has been restored from a backup taken before the overwrite, to the exact original value, and the correction is published and anchored alongside the disclosure. We did not edit the first record. It is anchored, and quietly revising our own account of a mistake would be a worse failure than the mistake.
A commitment proves the published numbers were not altered after publication. It does not prove they were right when published. This cooperative could publish a wrong total once and commit to it faithfully, and these checks would all pass.
What catches that is members checking their own balances against the same root — each one verifying the number beside their own name. That is what my‑balance is for, and the two pages are halves of one argument. Neither is sufficient alone, and we would rather say so than let this page look like more than it is.
No individual balance can be verified here, by anyone, including us. That is deliberate: publishing balances would publish a permanent record of who helped whom, and that record would outlive everyone in it.
The figures come from /public-commitments, which needs no key and returns no personal data. Everything else on this page is fetched from Horizon by your own browser.