Satsignal’s sealed mode is for the cases where the existence of a proof is itself sensitive — legal exhibits before disclosure, source material before coordinated release, evidence preservation when knowing-of-possession changes the situation.
Both modes anchor on the Bitcoin SV chain and produce the same portable bundle format. The difference is what the on-chain entry reveals to a third party.
The chain entry contains the file’s actual fingerprints. Anyone with your file’s SHA-256 can confirm a Satsignal proof exists for it. Right for releases, customer-facing receipts, code-signing, public attestations.
The chain entry contains a salted commitment. Without the salt held only in your local bundle, an observer learns only that some file was anchored at time T — not which file, and not enough to confirm a candidate. You unseal publicly when you choose to.
The cryptographic construction (HMAC-SHA256 with HKDF-derived per-leaf salts so that selectively disclosing one page or row does not unseal the rest) is documented in SPEC_v2_sealed.md.
Public mode is a published timestamp. Sealed mode is a sealed envelope — preserved cryptographically, opened when you choose. Both produce the same `.mbnt` bundle format; the same single-file verifier handles both, auto-detecting from the bundle’s manifest.
The bundle itself becomes a bearer secret in sealed mode: anyone holding the bundle can verify the anchor against any candidate file. Treat it as you would the file. Lose it to an adversary and the seal is broken; lose it entirely and the proof can no longer be verified, even though the chain entry is permanent.
Selective disclosure is preserved. You can later publish a single page of a sealed PDF, or a single row of a sealed CSV, with a per-leaf salt and Merkle path — verifiers confirm the chunk was part of the originally-anchored file without learning anything about the rest.
Sealed receipts are bearer-secret artifacts. Before granting access we’ll talk through your use case, the operational discipline required, and the exact failure modes — we’d rather you understand the model than ship something brittle.