DEMO. Everything on this page is a demo: fictional people and addresses (.example), stub tools that do nothing, and a witness key derived from a public sentence, so anyone could sign with it. The pack shows what evidence looks like and that its bytes check out; it proves nothing about a real service.
Watch an agent get attacked. Then check the evidence yourself.
For agents that run with nobody watching: cron, claude -p, CI. Deus Witness sits between an AI agent and its tools and allows, denies or holds each call according to rules you signed with a passkey. Here a compromised assistant tries 5 scenarios (14 calls). Each call went through the real witness
server; below is what it decided, and the signed evidence pack it produced. No account needed.
Check the pack in this browserCheck it on your machine
Live: an unattended agent calls the real service every hour, under a signed mandate; its evidence pack is signed by the service’s own key.
Decisions, call by call
Loading the decision feed...
Check the evidence pack in this browser
The checker below runs in your browser (js/packcheck.js, no server call, no code shared with the server). It fetches the files of the pack and checks: every file's SHA-256 against the manifest; the witness signature (Ed25519, COSE) on the manifest, on every ledger entry, on the checkpoints and on the receipts; the hash chain of the ledger; the Merkle roots of the checkpoints; that each receipt is the entry it claims to be; that the checkpoint sits under the hourly anchor batch root. Then it matches each line of the feed above against the signed ledger.
What this browser check does not cover
- The owner's passkey signatures (WebAuthn, ES256) on the mandates and the approval: the Python checker checks them (command below). Re-deciding every action against the mandate: neither check does that; the Python checker says so (“verdicts … NOT replayed”).
- The time stamps of the anchor root (Bitcoin via OpenTimestamps, RFC 3161): in this demo the root is not sent anywhere.
- That the witness key is the real service's key: here it is a public DEMO key on purpose. For a real pack, compare
kid_hexwith/v1/witnessof the service. - This page and the checker are served by the same site as the pack. Use the command below to check without trusting this page.
Check it on your machine: one command
Python 3.10+ in a throwaway venv, offline after the download:
curl -fsSLO https://witness.sipkigroup.com/demo/deus-witness-demo-pack.zip && python3 -m venv /tmp/dw-demo && /tmp/dw-demo/bin/pip -q install deus-witness && /tmp/dw-demo/bin/deus-witness-verify-pack deus-witness-demo-pack.zip --offline
Expected last line: RESULT: VALID. That command runs the checker from the deus-witness package (PyPI, open source), not the copy inside the pack, so it does not depend on the pack's author. It checks signatures, hash chain, Merkle roots, key registry and anchors; it does not replay the witness's decisions (the output says so). The pack also carries its own copy (verify/verify_pack.py, files listed with SHA-256 in manifest.json) that does. On the live page the key id comes from the server, not from the pack (--witness-kid). Download: deus-witness-demo-pack.zip
(SHA-256 ...).
Your own agents
When you have seen enough: an account takes a passkey and a minute. Your evidence packs are signed by the service's own key, not this demo key.
Running it unattended? A call that needs you waits up to 10 minutes for your passkey (the link comes to Telegram, Slack, e-mail or a push). Nobody answers: the call does not run, and our cron and CI templates fail the job (exit code 3). Nothing re-runs it for you; if you approve later and re-run the job within 15 minutes of the request, that exact call passes once. Or tick “also for later runs” when you approve: that exact call then also passes in the next runs, up to 10 more times within at most 72 hours (a shell command: until the agent writes a script it runs). For Claude Code's shell both need the hook deus-witness 0.2.33 or newer.
Guide for cron, claude -p and CI.