AI agent machines
kiss-protocol — the Witness itself. Install it before the agent, then let it record drift, network activity and agent events. v3.3.3.
Harborlight Witness
A record nobody can quietly rewrite.
The Witness writes what a machine saw and did to an append-only log, seals it with a signed head, and keeps a copy of that head somewhere else. Editing, deleting or cutting off the record afterwards is detected, and a signed bundle lets someone outside check it on their own machine without trusting ours.
What it is
Two binaries, one hard boundary.
- Merkle log
- An RFC 6962 Merkle log with signed tree heads. A snapshot of the machine is taken before any AI agent is installed; drift, network traffic and anomalies are logged from then on.
- Off-site mirror
- A transparency mirror keeps a copy of the signed head. A cover-up done with the machine's own keys passes local checks and is caught by the mirror audit.
- Restart-safe feeds
- Event feeds from Pipelock, the Split-Brain Harness and farm controllers. When the witness comes back up it catches up on what was written while it was down, and the record says so.
- Separate enforcer
- The enforcer runs the gossip mesh and cross-node alerts. It reads the core log read-only and cannot write to it.
- Signed releases
- Releases are cosign-signed, with instructions for verifying them and for reproducible builds.
- Detects, records
- It does not stop anything happening. It makes what happened hard to deny later.
Where it runs
The same log behind four very different rooms.
Poultry farms
harborlight-poultry-demo — a 30-second run on a simulated poultry operation: a normal day, the witness going down and catching up, a house controller going quiet, and four attempts to rewrite the record, each caught.
Warehouses
Harborlight Node — an offline edge node on site hardware. The AI is advisory-only behind a policy gate and a human review queue; every step goes to a witness ledger, with one-way batch sync to a cloud mirror.
Police evidence rooms
SLATE — chain-of-custody evidence management on a department-run node. No cloud. Encrypted, hash-chained audit log, role-based access, a signed truncation anchor and Ed25519-signed court exports. v1.5.0.
Witness logging
A record a stranger can check.
Mirror Node Reconnaissance carries the witness log's specification and its checks: a SHA-256 chain, a create-once seal, and witness-bundle/2 — an Ed25519-signed export with the node's signed head and a Merkle inclusion proof for every entry. Its verifier is written in Python with no dependencies and shares no code with the producers, so a recipient pins two public keys and checks the bundle offline.
| Input | Result |
|---|---|
Bundle from kiss-protocol (v1) | VERIFIED |
Bundle from slate (v1) | VERIFIED |
witness-bundle/2 from the Rust producer and from slate's Go port | VERIFIED |
| Unsigned bundle | UNAUTHENTICATED — never VERIFIED |
| 10 forged-but-signed bundles | Each rejected at the step that should catch it |
Limits
What the record cannot do.
Stated at the same level of detail as what it can.
- It detects; it does not prevent. It controls nothing and cannot keep a house running or stop an agent.
- Custody matters. The log is signed on the machine that keeps it. Someone with full control of that machine could rewrite and re-sign it; a copy of the signed head kept elsewhere is what catches that.
- No trusted time yet. Timestamps are self-reported. Nothing here is a trusted timestamp or, by itself, a legal artifact.
- The new bundle format is not everywhere yet. The slate port to
witness-bundle/2is a staged patch, not a release, and kiss-protocol is not ported. Released versions still write v1 bundles, which the verifier still checks.
Also built on it
Private deployments.
HIFAS, a fraud-analytics engine for a sensitive government domain, feeds its records into the witness rather than keeping its own log. Described at capability level only.
Pilots
Need a record that holds up?
Tell us what you need to prove, and to whom: an insurer, an auditor, a court, yourself six weeks from now.