One receipt covers a whole day on site. Show one photo later without showing the rest.

The natural unit is one folder per job site per day, anchored at end-of-shift. A larger unit — one folder per phase or per milestone — is reasonable when assembling closeout packets. The folder contains every photograph the field crew captured during the visit, ordered by the relative path under which it was filed.

The office never sees the photographs. The desktop or browser tool computes a SHA-256 fingerprint of each file, binds the file's relative path into a leaf hash under RFC 6962 domain separation, and assembles the leaves into a Merkle tree whose root is submitted to the OpenTimestamps calendars. The bytes of the photographs themselves do not cross the wire.

The root is then anchored to a Bitcoin block, and an OpenTimestamps proof for that root is delivered back to the contractor. The proof is sufficient, on its own, to demonstrate that the anchored folder existed by the time of the recorded block.

A claim arises months after the slab pour that the rebar spacing was non-compliant on a specific date. The contractor produces the single photograph of the rebar mat under the slab, together with an inclusion proof — approximately log2 N sibling hashes — that demonstrates the image was a leaf of the anchored end-of-day folder for that exact date. The remaining contents of the folder are not exposed by the proof.

The office persists, per anchored folder, the Merkle root, the canonical ordering rule applied, the per-leaf relative paths, the per-file SHA-256 digests, the per-file byte sizes, the Bitcoin attestation for the root, and, when supplied, an optional device signature under a did:key identifier or a capture-credential issued under a published trust list. A contractor for whom path names are themselves sensitive may anchor under a hash-labeled scheme in which the recorded path is the file's own digest.