The witness network
A history that can’t quietly rewind.
Receipts verify offline, forever. The one thing offline verification can’t prove is that you’re looking at the latest history. The witness network closes that gap: independent operators co-sign every history’s growth, so hiding or rewriting the recent past stops being deniable — and starts being evidence.
The witness directory.
A quorum is only as honest as its operators are independent. The directory lists conformant witnesses with the facts a declared set is chosen by — operator, jurisdiction, infrastructure — and their live status. Listing has exactly one requirement: pass the published conformance harness.
| witness | operator | jurisdiction | infrastructure | status |
|---|---|---|---|---|
| auths-w1 | Auths (first-party) | UK | fly.io · lhr | up · anchor + kel + cosign |
The network is young, and that is the honest state of it. Independence is what makes the honesty ceiling real — which is why the most valuable witness in this directory is the one we don’t run.
Run a witness.
# the node: spend anchors + receipt witnessing + cosigning
$ git clone https://github.com/auths-dev/auths
$ cd auths/deploy/witness
$ WITNESS_SEED=$(openssl rand -hex 32) docker compose up -d
✓ witness-node: listening on 0.0.0.0:3333
# prove conformance — the directory’s only entry bar
$ cargo xtask witness-conformance --url http://127.0.0.1:3333
✓ live endpoint passed 4/4 transport checks
The witness is one container with a persistent volume: a hardened HTTP surface, a durable anchor store, an append-only log, and one Ed25519 identity. The same compose file, Helm chart, and Terraform we run ourselves ship in the open repo — the infrastructure is the product, not a diagram of it.
Then hand the key to your principal
On first boot the node mints its member key and prints it. Whoever’s history you witness adds that key to their declared set — name, curve, public key, operator facts — and anchors the set in their own key history. From then on, your cosignature counts toward their t-of-N, and nothing about it requires trusting us: the node, the verifier, and the conformance harness are all published code.
What witnesses actually solve.
A dishonest counterparty doesn’t need to forge anything — forgery is already futile. The cheap attacks are withholding (pretend the recent records don’t exist) and equivocation (show two consistent histories to two different verifiers). Both are freshness problems, and no amount of offline math on a stale copy can catch them.
So the network witnesses exactly one claim, over and over: this history only grows. An agent periodically anchors its aggregate — head, count, cumulative — with a set of witnesses it declared in advance. Each witness accepts only monotone growth. Present the same index with a different head to any of them and what you get back is not a cosignature but a duplicity proof: a self-contained, signed contradiction any stranger can verify.
Verification itself never changes hands: it stays offline, free, and dependency-less. A finalized anchor simply adds one labeled fact beside the verdicts — fresh · stale · unanchored — and witnesses never see a per-call row, only the aggregate.
Every settled call appends to a signed hash chain. What leaves: one aggregate — head, count, cumulative — committing to all of it, revealing none of it.
Rolling history back now requires contradicting a quorum's signatures in append-only logs — a rollback is no longer a deletion, it is evidence.
The cloud network.
Everything that proves is open and free: the protocol, the verifier, the full witness node, the watcher. What we sell is operation — uptime, a curated quorum, storage, and alerting. The gate is an account, never a code path.
Anchoring
metered by anchors / month
Submit your agents’ aggregates to a curated quorum that spans the diversity policy’s floors — distinct operators, jurisdictions, and clouds — and get back finalized, offline-checkable anchors.
Monitoring
metered by seeds watched
A hosted watcher over the histories you care about: duplicity and withholding alerts the moment a fork or a silence appears, dashboards over the same open artifacts anyone can re-check.
Pinning
metered by GiB-months
Ciphertext-only custody of your records keyed by (head, index), with availability proofs — and a signed non-response artifact if we ever fail to serve one. Honesty, contracted.
Pricing lands with the launch. And if you’d rather not pay us at all: everything above this section runs from published code, which is precisely the point — the docs walk every role through it.