Sealed the day it was sent.

Each issue is hashed as sha256(salt + "\n" + canonical_json) and published that day. The salt and payload are revealed later, so you can check nothing was changed after the fact.

SALT=…   # from the revealed payload
JSON=…   # canonical JSON, byte for byte
(printf '%s\n' "$SALT"; printf '%s' "$JSON") | shasum -a 256