OrderedStrength.

A strength coach for iPhone that changes your session while you are in it, based on how the sets you have already done compare to what it expected.

It writes things down before you lift. Before each session, it seals a prediction for each lift: the range it expects your estimated max to land in, given everything it knows about you. That prediction is committed with a cryptographic hash. You can check after the fact that nothing changed.

It grades itself. When the session ends it compares what you lifted to each prediction, records the result against it, and the algorithm reads from that record when it makes the next prediction. The published accuracy rate goes on the record page as each whole month is graded, on the 2nd of the month after.

Binding: changing a prediction after it is sealed requires a SHA-256 collision, meaning two different predictions that produce the same fingerprint. That is about 2¹²⁸ operations, a number with 39 digits, which is another way of saying nobody has ever done it and no machine that exists could.

Hiding: the sealed fingerprint reveals nothing about the prediction. The prediction is mixed with a 32-byte random number, the nonce, so nobody can work it out by trying every possible prediction.

Timestamp: one Merkle root is published for each day on which seals arrive, to a public repository, by an automated process running inside that repository rather than on our server, so a token stolen from our server cannot write there. A fingerprint inside a published day existed no later than the moment that day closed, and GitHub's own record of when that upload happened is the evidence, not ours. It dates a prediction to the day. The seal and the set usually fall inside the same day, so on its own it cannot show which came first; a seal re-sent and posted on a later day cannot show it came before the result at all.

Open verification: the verifier at orderedstrength.com/verify/ requires no account and stores nothing. Anyone can check any receipt.

Each published day names a scheme, os-merkle-v1-sha256, and the file beside it lists that day's fingerprints. These four rules turn that list back into the published root, and nothing else is needed.

1. Sort the fingerprints as text, so the root does not depend on the order they arrived in.

2. A leaf is SHA-256 of a single byte of value 0 followed by the ASCII text of that lowercase 64 character fingerprint. The text, not the bytes it decodes to.

3. A parent is SHA-256 of a single byte of value 1 followed by its left child then its right child. The two different leading bytes are what stop a leaf being passed off as a parent.

4. An odd node moves up unchanged. It is never duplicated to make a pair. Duplicating it is the common shortcut and it is the one that lets two different lists produce one root.

Repeat rules 3 and 4 until one node is left. That node is the root printed on orderedstrength.com/record/. Three independent implementations of this are kept deliberately, in the app, on the server and in the publishing process. The app and the server are tested against the same fixed root, and the publisher refuses to publish a day whose root does not match its own arithmetic.

The phones in the home page's pictures are a 3D model: Apple iPhone 15 Pro Max Black by polyman Studio, used under CC BY 4.0. The screens on them are real captures of the app.