v0.4.0 — Authenticated time witnesses (2026-08-21)

The lower causal bound becomes cryptographic. Under the NTP profile a server
echoes the challenge-derived nonce; under the new ROUGHTIME/v1 profile the server
Ed25519-signs a Merkle root containing it. Epoch 3 puts both classes in one
checkpoint: two signed Roughtime witnesses (Cloudflare, txryan) beside the five NTP
witnesses, consensus q=3 of 7, anchored at height 264 with parent = B0 — the fourth
consecutive adjacent-block causal window, won on the first attempt.

B0 263  ≺  signed acquisition 06:17 UTC  ≺  C 264 (epoch 3)
bundle   vectors/valid/roughtime-sandwich-bundle.cbor
verdict  SANDWICH_PASS_UNBURIED — all checks incl. S_ROUGHTIME_SIGNATURES;
         burial depth 0 at publication (the laboratory miner had not yet
         extended the chain; its gaps run 6-184 min). Re-running
         scripts/assemble_g5_bundle.py records burial when it lands.

⚠️ Superseded by v0.4.1: the height-264 anchor above was orphaned. The block
was real and briefly the tip, but lost a chain race. The claim is left standing
here with this pointer rather than edited away; the corrected anchor and the full
account are in v0.4.1 below and in
live/anchor-evidence/ROUGHTIME-SANDWICH-ACCEPTANCE.md.

New in this release:

• ctp/roughtime.py — IETF-draft Roughtime client and complete offline verifier:
  challenge-derived nonce, Merkle inclusion, response signature, delegation
  signature against pinned long-term keys, delegation-window containment. Ed25519
  through the OpenSSL CLI, so no new Python dependencies. Every wire constant was
  pinned empirically against live servers before being hard-coded.
• scripts/run_g5.py, scripts/assemble_g5_bundle.py, tests/test_roughtime.py
  (synthetic round-trip with four tamper cases). Suite: 29 tests.
• scripts/ots_upgrade.py (from v0.3.1) and the normative profile in
  docs/REALITY-SANDWICH.md §3b, including the honest precision trade: signed
  evidence is currently ±2–4 s against NTP's ±30–200 ms.

Record: live/anchor-evidence/ROUGHTIME-SANDWICH-ACCEPTANCE.md.
The epoch chain now reads 0 → 1 → 2 → 3, every link committed into proof-of-work.

---