What it does
Each party sends every event of a deal as it happens: deal id, its id, event type, the SHA-256 of the content (never the content) and its Ed25519 signature. Witness checks the signature, fixes that party's key for the deal, adds its UTC time and a chain hash over the previous receipt, and returns a receipt signed with the key below. Anyone holding the receipts can check them offline. Kept: deal id, party ids and keys, and per event the type, content hash, party signature, time and chain hash, for 400 days after the last event. Never kept: content or addresses. No model. It does not show that the content is true or who the party is.
- Where it sits
- Agents › Trust › Witness
- Who it is for
- Agents and businesses in a live deal who want a neutral, checkable record that each of them sent a given hash at a given time and in a given order.
- Price
- Free: 120 events an hour per address. A per-receipt fee is planned, not charging.
- Limits
- Six text fields: deal_id and party_id (1 to 64 of letters, digits, _.:-), event_type (lowercase, up to 32), content_hash (SHA-256 hex), public_key (Ed25519, canonical base64; weak keys refused) and sig. The party signs the canonical JSON of {content_hash, deal_id, event_type, party_id, type: witness-event, v: 1}. Up to 200 events and 8 parties per deal; 4 KB per call. A party's first event fixes its key for that deal; another key under that party id is refused. This binds a key to a name only inside one deal, not to a person. Use a long random deal id: anyone who knows it can add events, and the first sender takes an unused id. Sending an event again returns the same receipt. Time is our UTC clock and the order we saw events in; anyone holding a signed event can send it later. Witness does not show that the content is true, that nothing was sent that it did not see, or who the parties are. No verifier can show that nothing came after the last receipt you hold. No public log of receipts yet (step bp-ts2).
For developers: try it
POST https://llpro.ai/mcp tools/call witness_record
{"deal_id":"<random id both sides use>","party_id":"alice","event_type":"offer","content_hash":"<sha256 hex of the content>","public_key":"<b64>",
"sig":"<b64 signature over the canonical JSON of {content_hash,deal_id,event_type,party_id,type:'witness-event',v:1}>"}
-> receipt: seq, witnessed_at, prev_chain_hash, chain_hash, signed observation
Chain hash = SHA-256 of the canonical JSON of {v:1, deal_id, seq, prev_chain_hash, party_id, public_key, event_type, content_hash, party_sig, witnessed_at}.
The first receipt of a deal has prev_chain_hash of 64 zeros.
Offline verifier and test vector: llpro.ai/witness-verify (witness_verify.py, runs without our server).
For agents
Tool witness_record on https://llpro.ai/mcp and in the tools list. Signed answers are checked with the public key below (signer llpro1:ofmqnj43wtlwcbwvo75bxgdqha): an Ed25519 signature over the observation as canonical JSON (sorted keys, no spaces).
Public key (base64): sfoAUuRjyvP2yXW/howd1kbWSuIDfwpj/eJuwxwg/xM=
For agents: this page as Markdown · JSON · llms.txt · MCP endpoint llpro.ai/mcp · agent card