Agentic Witness

A process that witnesses the agent. Not an agent that witnesses.

Agentic Witness is an extension to Lotor that operates the third witness in a triangulated audit architecture. Lotor is the first witness (observes the agent at the hook layer). The MCP wire sidecar (WO-WIRE-01) is the second witness (observes at the transport layer). Agentic Witness is the third: it observes the first two rather than the agent, and produces its own signed meta-chain.

The frame the design commits to is Clue, not The Usual Suspects. Three witnesses do not always converge on one truth. When they disagree, Agentic Witness surfaces the divergence and stops. It never renders a verdict. Adjudication belongs to the operator now, and eventually to a neutral custodian.

Why the third leg matters

Lotor alone is one witness held by the same operator as the subject. Its confession log — KNOWN-LIMITS.md in the Lotor repo — is honest about what that means: silence is not safety, capture is self-attested, and a clean receipt is not the same claim as a complete record. Adding a wire-level sidecar covers a different set of gaps but does not close the trust structure, because both witnesses still live in the same operator's hands.

The third witness's independence rests on three legs of its own:

1. Different code. Separate repository, separate implementation, no shared libraries with Lotor beyond standards (Ed25519, PBKDF2, JSON). A bug in Lotor's parser does not propagate into the meta-chain.
2. Different key custody. Agentic Witness derives its signing key from a passphrase distinct from Lotor's. Compromising one does not compromise the other.
3. Different observation surface. Agentic Witness does not watch the agent. It watches Lotor's chain, Lotor's hook registrations, Lotor's confession log, and eventually the wire sidecar's trace. These are the outputs and behavior of the primary witnesses, not the events they observed.

On-machine v1 satisfies the first two fully and the third structurally. Off-machine deployment with a custodian-held key (v2) is a later release. This repository ships v1.

What Agentic Witness actually does

Every snapshot, on a schedule you set, it appends a signed entry to its own hash-chained log:

{
  "seq": 42,
  "observed_at": "2026-07-30T02:00:00-05:00",
  "lotor": {
    "chain_head": "sha256:...",
    "entry_count": 1234,
    "verify_ok": true,
    "last_session_id": "..."
  },
  "sidecar": null,
  "hooks": {
    "registered": ["SessionStart", "PreToolUse", "PostToolUse", "SessionEnd"],
    "settings_sha256": "..."
  },
  "confessions": {
    "entry_count": 44,
    "file_sha256": "...",
    "lotor_head_at_last_confession_write": "..."
  },
  "prev_witness_hash": "sha256:..."
}

Then witness status presents the diff since the last snapshot: what changed in Lotor's chain, whether the hooks are still registered, whether the confession log kept pace with Lotor's source, whether the sidecar (when integrated) agrees. The output is a diff, not a verdict.

What it is not

• Not an MCP server. Adding one would put Agentic Witness back inside the agent trust boundary and defeat the third-leg design. Any future agent that reads the meta-chain does so via witness status or by reading the file directly.
• Not an adjudicator. When Lotor's chain says one thing and the sidecar says another, Agentic Witness reports both and stops. Picking which one is right is the operator's job.
• Not a replacement for Lotor. Without Lotor's chain to observe, Agentic Witness has nothing to say.
• Not a promise of adversarial-grade audit. On-machine v1 raises the bar; v2 (off-machine, custodian-held key) is where the argument gets structurally airtight.

Install (draft — populated at Stage 2)

Requires Lotor installed and running, and Node.js 20+.

git clone https://github.com/githubscum/agentic-witness
cd agentic-witness
npm install
npm run init                  # one-time passphrase setup
npm run snapshot              # produces the first meta-chain entry
npm run status                # shows the diff since last snapshot

Confession log

See WITNESS-LIMITS.md. It exists on day one, before any tool code lands, and it names what a fresh reader should know about the tool's honest posture. Same discipline as Lotor's own KNOWN-LIMITS.md, applied here.

License

Apache-2.0. See LICENSE.

Related

• Lotor — the first witness.
• WO-WIRE-01 in the Lotor design tree — the second witness (MCP wire sidecar).
• PDLC-I-witness-of-witnesses.md in the Lotor design tree — the design document this repository implements.