LoomWitness

A proposed producer for the LoomSeal format. Not shipped. This page describes what it would be, and exists to find out whether anyone wants it.

Your agent logs prove nothing. You wrote them.

An agent read a customer's data, called four tools, and changed something in production. A week later somebody asks what happened.

You can export the trace. It came out of a database you control, so you could have edited it before sending, and the person reading it knows that. Worse, if the run that matters was never recorded, or quietly disappeared, nothing about the export reveals it. An intact log and a complete log are different claims, and only one of them is being made.

Tracing tools answer what happened for you and your engineers, which is what they are for. They cannot answer prove it for somebody who does not trust you, because the record lives with the party being questioned.

A boundary, not a library

The obvious version of this is a logging SDK you import and call. That version cannot work. If a code path forgets the call, or an agent runs somewhere else entirely, the result is a beautifully signed incomplete history, and no amount of cryptography fixes it.

So LoomWitness sits in the path instead: a gateway that agent tool calls pass through, on the model context protocol boundary. Every call that crosses it is sealed into a LoomSeal chain as it happens, and LoomSpan beats attest on a cadence that none were dropped in between.

Placement alone is not enough, and this is the part that is usually hand-waved. A proxy does not stop an agent from reaching a tool directly. What closes the boundary is credential custody: the gateway holds the keys, the agent holds none, so a call that goes around the gateway has nothing to authenticate with. The completeness claim is earned by that, not by the diagram.

Check one yourself, right now

Everything above is an argument. This part is not. Below is a real sealed record of an agent session: six tool calls, two population attestations, chained, signed, and anchored. Download it and check it on your own machine, offline, with nothing installed from me.

curl -O https://loomseal.com/witness/agent-window.loomseal.json
go install github.com/kordloom/loomseal@latest
loomseal verify agent-window.loomseal.json

That prints, and this is the actual output, not a mockup:

bundle     lsb_witness_demo_0001 from loomwitness-demo 0.1.0
subject    url mcp://demo-agent-tools
signature  ok, key sha256:03396219237f75a64f12aeb7f39723abf400b160c364980a765dac24aeba2464
chain      loomseal-chain-v1, full, 8 claims, head matched true
anchors    1 matched by coordinates, 0 proof(s) carried, 0 verified
anchored   through seq 8
note       1 anchor(s) name a location this verifier did not fetch; confirm them yourself
span       2/2 windows attested, 2 count(s) recomputed
note       unknown claim type loomseal.agentrun/1, not checked against a registry entry
VERIFIED   signed, chained (full), anchored by reference, spanned

Read the notes, because they are the honest part. The verifier says it did not fetch the anchor and tells you to confirm it yourself. It says the agent claim type is not in its registry, because LoomWitness does not exist and the type is not registered. It reports coverage as a measurement rather than a badge. A tool that wanted to impress you would have printed none of that.

Open the file in an editor first if you like. Change one character anywhere, then verify again and watch it name the break. You can also drop it into the browser verifier, which runs entirely on your machine.

The session is synthetic and the timeline is a demonstration. The cryptography is not: the links recompute, the signature checks, and the Go and Python verifiers agree on it independently.

What it would prove, and what it would not

It would prove that every tool call crossing the attested boundary was recorded in order, that nothing was altered afterward, that nothing was removed without the chain breaking, and that the record existed before an anchor the producer could not reach.

It would not prove what the agent was thinking, that the agent was right, or that no activity happened outside the boundary. Coverage is a property of where the gateway sits, not of the mathematics. Anyone who tells you a signature solves that is selling something.

Who this is for

Companies that sell AI agents to other companies, and have started running into the security review. Your agent takes actions inside a customer's environment, which means it landed inside a scope somebody already gets audited against. Their reviewer asks what it touched, what it changed, and who approved it. You send a dashboard and ask to be believed, and the deal slows down.

This is not a compliance product and it will not fill out a questionnaire for you. It is one file the customer's own engineer checks offline, without an account and without calling you, so that the conversation ends instead of scheduling another call.