OrderedStrength.

A strength coach for iPhone that changes your session while you are in it, based on how the sets you have already done compare to what it expected.

It writes things down before you lift. Before each set, it seals a prediction: the load it expects you to be capable of, given everything it knows about you. That prediction is committed with a cryptographic hash. You can check after the fact that nothing changed.

It grades itself. After each set it compares the result to the prediction, records the result against it, and the algorithm reads from that record when it makes the next prediction. The published accuracy rate goes on the record page once whole months have been graded, and no month has been yet.

Binding: changing a prediction after it is sealed requires a SHA-256 collision. That is about 2¹²⁸ operations, a number with 39 digits, which is another way of saying nobody has ever done it and no machine that exists could.

Hiding: the commitment discloses nothing about the prediction. A 32-byte cryptographic nonce means the prediction space cannot be brute-forced.

Timestamp: one Merkle root is published per day to a public repository, by a job running inside that repository rather than on our server, so a token stolen from our server cannot write there. A fingerprint inside a published day existed no later than the moment that day closed, and GitHub's own record of when that push happened is the evidence, not ours. It dates a prediction to the day. The seal and the set fall inside the same day, so it does not on its own order one against the other.

Open verification: the verifier at orderedstrength.com/verify/ requires no account and stores nothing. Anyone can check any receipt.

Each published day names a scheme, os-merkle-v1-sha256, and the file beside it lists that day's fingerprints. These four rules turn that list back into the published root, and nothing else is needed.

1. Sort the fingerprints as text, so the root does not depend on the order they arrived in.

2. A leaf is SHA-256 of a single zero byte followed by the ascii text of that lowercase 64 character fingerprint. The text, not the bytes it decodes to.

3. A parent is SHA-256 of a single one byte followed by its left child then its right child. The two different leading bytes are what stop a leaf being passed off as a parent.

4. An odd node moves up unchanged. It is never duplicated to make a pair. Duplicating it is the common shortcut and it is the one that lets two different lists produce one root.

Repeat rules 3 and 4 until one node is left. That node is the root printed on orderedstrength.com/record/. Four independent implementations of this are kept deliberately, in the app, on the server, in the publishing job and in a cross-check, and the publisher refuses to publish a day whose root does not match its own arithmetic.