Only worth what an outsider can check.

What is recorded

Two streams, no frightening permissions.

1. File checkpoints.

   Every watched file is fingerprinted with SHA-256 when its size or modification time moves, and again on a sixty-second sweep. Each checkpoint records the time, a salted digest of the path, the content hash, and the size. Never the content.

2. Application focus.

   Which application is frontmost, sampled every two seconds and kept only as a running total per application — never as a timeline.

3. Pen rhythm.

   How often the pen or mouse moves or clicks while a drawing app is in front. A gap of a quarter second ends a stroke; strokes are counted per minute; stylus pressure is checked only for whether it varied. Positions are never read — macOS reports the movement without them, and the monitor needs no accessibility permission. Nothing is asked of the artist: no file to create first, no saving as you go.

Screen time-lapse is designed but not shipped.

The chain

Each save is locked to the one before it.

Removing, reordering, or editing an entry breaks every link after it, and the final link — the chain root — is what gets published and timestamped.

chain[-1] = SHA256("drawdog/genesis/v1" || len(session_id) || session_id)
chain[n]  = SHA256(chain[n-1] || encode(entry[n]))

The exact encoding is specified in docs/CHAIN-SPEC.md, in enough detail to write an independent verifier. A chain that walks cleanly is only internally consistent — truncation is caught by comparing the recomputed root against the published, timestamped one.

Signing and timestamping

Our clock is worth nothing here.

The summary is signed on your machine with a key that never leaves it, and the public half is registered to your account — which is what lets a certificate say whether a signature really belongs to the person whose name is on it.

The signed digest is then submitted to a public RFC 3161 timestamp authority. We are the interested party, so we don’t assert the time; a third party does, and the token on each certificate can be checked with OpenSSL using tools we don’t control.

How a grade is decided

Fixed rules. No person decides.

Certified human-made requires all of:

• No AI tools open at any point.
• At least 5 minutes of pen or mouse activity inside a drawing app and at least 150 strokes, with the rhythm of a hand: strokes per minute that rise and fall, not a metronome. Clicks count — vector work is mostly clicks — and a pause under four seconds is still drawing.
• Or, only if the pen couldn’t be watched: at least 12 saves and 10 minutes of work, with the file less than 60% finished at the start and no single save adding more than 80% of it.
• A finished file that appeared with no drawing seen is never certified.

Any AI-tool time at all makes it Human-made with AI help, disclosed with percentages and tool names — one second counts, because disclosure is binary. Everything else is Recorded, not certified. No AI is not by itself a certification: a session with no AI and no evidence of work is not certified, and the certificate says which condition it missed.

The list of what counts as an AI tool ships inside the app and is shown in full on its disclosure screen. No hidden heuristic decides a grade.

Limits

What this cannot prove.

The retype attack.

Generate work elsewhere, then reproduce it by hand in a watched folder. The chain records a genuine, organic process, because one happened. Nothing in this design catches that. The claim is a notary’s, not a proof: faking it costs more than doing the work.

One machine only.

Work done on another computer, an iPad, or a phone is invisible.

Browser time is unattributed.

We don’t read tabs, deliberately. A web-based AI tool in Safari looks identical to a reference photo in Safari. When browser time is a meaningful share of a session, the certificate says so rather than counting it as clean.

Strokes are counted, not judged.

A stroke is a burst of movement with a drawing app in front. Idly wiggling a pen for ten minutes would count. The rhythm check catches scripted, evenly spaced input, not a person deliberately padding a session — that is the retype attack again, and it costs what it costs.

It is not an AI detector.

DrawDog never looks at the artwork and makes no claim about it. Anyone reading a certificate as “this image is not AI” has read it wrong.