How Dev Shops Can Prove Work Delivery with Timestamp GIT

Maya runs delivery at a 14-person dev agency. Last Tuesday, a client refused to pay a $38,000 milestone. The feature was shipped, tests passed, and the pull request was merged on June 14. The client’s procurement team claims the milestone arrived ten days late, so the invoice should be reduced.

Maya exports the Git history from the repository. It shows the merge exactly when she says. But the client’s lawyer waves it away: “That’s your server, your log, your dates.”

This is the moment Timestamp GIT changes the argument.

Timestamp GIT is a managed GitHub App for dev shops and agencies that automatically anchors every commit hash to the Bitcoin blockchain. It creates an immutable, third-party record of exactly when work existed — without reading your source code, installing CLI tools on developer machines, or asking anyone to become a blockchain expert.

The Agency’s Nightmare: When a Client Disputes Delivery

For an agency, the delivery dispute usually follows a pattern. The client approves a milestone at the kickoff. The team builds the feature, opens a pull request, gets sign-off from the client’s product owner, and merges. The agency sends the invoice.

Weeks later, the client’s finance team says the work arrived late. Or they claim the feature was incomplete at the milestone date and had to be rebuilt internally. Sometimes the claim is specific: “The dashboard module did not exist on the 15th.”

The agency’s first instinct is to show the Git log. The commit hash is there. The timestamp is there. The branch history is there.

The problem: standard Git history is not independent evidence. It lives on infrastructure you control. Dates can be rewritten, rebased, force-pushed, or hosted on a server you administer. In a legal or procurement dispute, the other side can dismiss it as self-serving — because technically, it is.

What Maya needs is not another log. She needs proof that a specific fingerprint of the code existed in a specific Bitcoin block at a specific time. That proof cannot be edited, backdated, or deleted by the agency, the client, or even the platform that created it.

Timestamp GIT produces that proof automatically.

Why Dev Shops Need Cryptographic Proof of Delivery

Agencies face three related risks that internal Git history does not solve.

Payment disputes

A client can delay or reduce payment by claiming a milestone arrived late, incomplete, or not at all. Agencies often settle because proving delivery is expensive. A cryptographic receipt changes that calculation: the client cannot dispute when the commit existed when the proof is anchored in Bitcoin.

Liability for missed deadlines

Sometimes the agency is accused of causing a missed product launch. If the dispute escalates, the agency needs to show exactly which features were finished on which dates. Commit-level timestamps create a precise timeline that does not depend on the agency’s word.

Non-performance claims

A client may claim the agency never delivered a particular codebase, or that it had to start from scratch. Timestamped commit hashes link the delivered work to a verifiable point in time, making those claims much harder to sustain.

Traditional evidence — emails, internal project management logs, screenshots, server access logs — is often treated as weak or circumstantial. Bitcoin-anchored timestamps are different: they are mathematically verifiable and immutable.

Timestamp GIT uses a zero-knowledge architecture. The agency’s source code never leaves the repository. Timestamp GIT extracts only the commit hash — a unique cryptographic fingerprint of the repository state — and anchors that hash into Bitcoin using the OpenTimestamps protocol. The result is a .ots receipt that can be verified against the Bitcoin blockchain.

For context on why this kind of evidence matters beyond delivery disputes, see Proof of Existence for Code: What It Is and Why It Matters.

The operational guarantees matter for agencies:

• Embedded in Bitcoin: The proof is public, immutable, and verifiable forever.
• Vendor independent: Verification relies only on SHA-256 and Bitcoin block data. No proprietary lock-in.
• Zero-knowledge security: Timestamp GIT never sees, copies, or stores source code.
• Court-ready evidence: The proof is a cryptographic chain from commit hash to Bitcoin block.

A Practical Playbook: Setting Up Timestamp GIT for Your Agency

The shortest path is the Standard Mode GitHub App. The setup is designed to be zero-maintenance.

Step 1: Install the Timestamp GIT GitHub App

Install the GitHub App on your organization and grant it access to the client repositories you want to monitor. In Standard Mode, the app reads only the HEAD commit hash of each monitored repository. It does not read file contents, pull request diffs, or source code.

The app requires read-only access to the source repository and read-write access to the target repository where proofs will be stored. You can keep proofs in a dedicated branch of the same repository or in a separate shadow repository.

Step 2: Configure monitoring for client projects

Once the app is installed, every new commit is detected automatically through webhooks. There is no manual step per commit, no script to run, and no developer workstation setup.

Step 3: Let the nightly worker anchor the day’s work

Timestamp GIT batches pending commit hashes every night. It creates manifest files, builds a Merkle tree, generates OpenTimestamps proofs, and anchors the Merkle root into a Bitcoin block.

The Bitcoin confirmation typically takes around three hours, so proof delivery is not instantaneous. It happens automatically after the block is confirmed.

Step 4: Receive .ots receipt files

Timestamp GIT pushes the manifest and .ots receipt files back to your repository in a dedicated timestamps branch or shadow repository. These files become your long-term evidence archive.

Step 5: Show clients real-time proof of delivery

You do not need to give clients access to your private repository. Timestamp GIT provides public verification pages, embeddable badges, PDF reports, and a CSV audit ledger.

For example, you can query the last anchored Bitcoin block information for a repository:

curl -s https://timestampgit.dev/api/statusLast/acme-agency/client-portal

The public dashboard shows the earliest anchor date, daily regularity, Bitcoin block and transaction data, and a calendar heatmap. Clients can use a badge link to view verification status and download the .ots receipt for independent verification.

For the broader GitHub App automation flow, see Automate Git Commit Timestamping with a GitHub App.

Self-hosted and enterprise alternatives

If you need an air-gapped or self-hosted deployment, Timestamp GIT is available as a Docker image. A typical Compose file looks like this:

services:
  timestampgit:
    image: rue1401/timestampgit:prod
    ports:
      - "8080:8080"
    volumes:
      - ./data:/app/data
    restart: unless-stopped
  valkey:
    image: valkey/valkey:8
    restart: unless-stopped

Start it with:

docker compose pull
docker compose up -d
docker compose logs -f timestampgit

The app is available at http://localhost:8080. A setup wizard guides you through connecting your GitHub App and configuring the instance. A time-limited demo license is available from the Docker License page.

For maximum isolation, Enterprise ZK Mode runs a 12-line GitHub Action on your infrastructure. It pushes only the commit hash to the Timestamp GIT API, so the source code never leaves your environment. In this mode, Timestamp GIT requires read-write access only to the target repository — no read access to the source repository.

If you are evaluating the managed approach against manual timestamping, see OpenTimestamps Alternative: Managed Timestamping for Git.

What to Avoid When Proving Work Delivery

Do not rely solely on internal Git history or server logs

Internal logs can be rewritten, backdated, or challenged as self-serving. They are useful supporting evidence, but they are not independent proof. Anchor the commit hash somewhere immutable.

Avoid manual timestamping processes

Manual processes are error-prone and inconsistent. Teams forget to run them, use the wrong branch, or lose the receipts. Use automation that catches every commit.

Do not expose source code to third-party timestamping services

A proof-of-delivery system should not require uploading your client’s code to an external server. Timestamp GIT only processes commit hashes, not source code. The zero-knowledge design protects both your agency and your client.

Do not wait until a dispute arises

By the time a client argues that a milestone never arrived, it is too late to build the evidence. Start timestamping from the first commit so every milestone has an unbroken chain of proof.

FAQ

How does Timestamp GIT prove exactly when a commit was made?

Timestamp GIT extracts the commit hash — a unique fingerprint of your code — and anchors it into the Bitcoin blockchain using the OpenTimestamps protocol. The Bitcoin block timestamp provides an immutable, publicly verifiable record of the commit’s existence at that time.

Can a client verify the timestamp without access to my private repository?

Yes. Timestamp GIT provides a public verification page and embeddable badges. The client can use the badge link to view the verification status and download the .ots receipt, which can be independently verified against the Bitcoin blockchain without exposing your source code.

What if the client disputes the timestamp’s authenticity?

The timestamp is anchored in Bitcoin, which is mathematically immutable. Anyone can verify the proof using the Bitcoin blockchain and the cryptographic chain from your commit hash to the Bitcoin block. That chain cannot be forged or altered, making the proof court-ready.

Is Timestamp GIT suitable for agencies working with multiple clients and repositories?

Absolutely. The GitHub App can monitor multiple repositories across your organization. The Pro Agency plan supports private repositories, and the dashboard provides an overview of all timestamped commits, making it easy to manage proof for many clients.

Conclusion: Make Delivery Disputes a Thing of the Past

For dev shops and agencies, the question “when did you deliver?” should never depend on whose server log the client chooses to believe. Timestamp GIT replaces that argument with a Bitcoin-anchored receipt.

Install the GitHub App once, connect your client repositories, and every commit is automatically batched, Merkle-rooted, and anchored into Bitcoin each night. Proofs land in a dedicated branch or shadow repository. Verification pages, badges, PDF reports, and audit CSVs give your clients a dignified way to confirm delivery without exposing source code.

Pricing starts with the Open Source tier for public repositories, the Pro Agency plan at $49/month for private repositories, and Enterprise ZK at $199/month for GitHub Actions-based workflows. If you need a self-hosted deployment, the Docker license is available with a demo option.

Start with the free public-repo tier or install the GitHub App for your agency’s repositories at timestampgit.dev.

Related posts

• Proof of Existence for Code: What It Is and Why It Matters
• Automate Git Commit Timestamping with a GitHub App
• OpenTimestamps Alternative: Managed Timestamping for Git