ABSuiteAI Black Box Recorder v1.8.1 · 6 of 8 layers built

Prove what your AI actually did.

Record what happened. Prove it happened. Preserve the evidence.

Every action is Ed25519-signed and hash-chained, so anyone can check the record — including people with no reason to trust you. Who acted, under what authority, under which rule, and whether a person approved it before it ran. Payloads are hashed, never stored.

Ready to check

Three real signed records are on this page. Nothing has been checked yet, so the core is dark — an empty instance shows an empty core.

  1. ·Content — each record hashed and compared to its own recorded hash
  2. ·Chain — every record links to the one before it
  3. ·Signature — Ed25519, against a public key that cannot forge

No install, no account, no server. Alter a record and the check names the exact sequence number that broke — which is the whole point: you are not being asked to believe this works.

Verify your own trace → See the whole system Source on GitHub Support this work

[ Where this is ]

6 of 8 layers built Read from the constitution at build time. The last two accrue with adoption rather than being written.
131 documented routes Generated from the source of the five services, and the build fails when the two drift apart.
9 packages in the monorepo 8 are public and MIT, published with a Sigstore attestation of the commit that built them. One — the operations room interface — is deliberately not.
49 test suites Files, counted. Not a coverage claim — a count of the files that hold the checks.

[ Sixty seconds ]

npm install @absuitecore/capkit

[ Questions it answers ]

What happenedA signed, hash-chained trace of every real action.
Who did itAn enrolled identity that proved it holds its own key — not a name someone typed.
Was it allowedScope checked before execution, not after.
What did it costSpend attributed to the agent that caused it, with coverage stated beside the total.
Was it alteredChain verification names the first broken record.
Can you re-run itReplay compares a re-run against the recorded hashes.
Did a person approve itAn approval bound to a hash of the exact payload, so it cannot cover a different one.
Is anything watchingA sweep that states how much of the record it has covered, so silence is never mistaken for health.
Which model answeredA fingerprint recorded at approval. A silent provider version roll reads FAILED, not unnoticed.

[ The four words ]

There is no trust score anywhere in this product, and the absence is the design. A number replaces evidence with something nobody audits — nobody interrogates a 96.4, they act on it. Every finding lands in one of four words instead, and each one can be disagreed with.

DEMONSTRATEDThe evidence supports it. Not “this is true” — the evidence for it is present and holds.
FAILEDThe evidence contradicts it. A record whose content does not match its own hash is not merely unproven.
UNKNOWNNobody checked, or this build cannot read it. Always carries the step that would settle it.
ABSENTThe record never attempted to answer. Always carries why it is silent — a field that predates a schema is not a field left blank.

Unknown is not the same as false, and its sharper corollary — unknown is not the same as true — is the one that was actually hiding in this codebase, and was found and fixed.

[ A rule that demands a person ]

Almost anybody can show that a human clicked approve.

Very few can show what exactly was approved. The approval and the action are normally linked by a foreign key the operator controls, so the link is a claim by the party being audited.

Here they are linked by a hash of the payload — the subject, the module, the action and the input, all four of which are on the finished execution too. So “was this approved?” is answerable from the execution record alone. An approval granted for one input cannot travel to another, and there is no approval id written onto the trace for anybody to fill in afterwards.

Two things are refused rather than warned about: the requester may not decide, and one approval covers one execution. A reusable approval is an authority, and authority is a capability token.

An execution recorded under a rule that said REQUIRES_APPROVAL, with nothing behind it, reports Governance as FAILED — not as a gap, and not quietly. A rule that demands human judgement, satisfied by nobody being asked, is not governance.

This is the strongest row in the compliance mapping, against the EU AI Act’s human-oversight article — which asks that an assigned person be able to decide, in any particular situation, not to proceed.

[ Something is watching, and it says how much ]

ABSuite sweeps its own record on an interval and raises what a person should look at. It ranks nothing, calls nothing an incident, notifies nobody and recommends nothing — every one of those is a judgement, and the judgement is not the witness’s to make.

What it does do is disambiguate its own silence. An empty list of findings means the last sweep found none, or it means nothing has ever swept — a container restarted, an interval never started, a sweep that threw three weeks ago. In a list those are the same picture, and the second is the more dangerous state a monitor can be in, because a system that looks watched is one nobody checks by hand either. So every answer carries how far the sweep got, and what it has not reached yet.

[ Verified twice, by two people who share no code ]

The record format is specified independently of this implementation, and then implemented again — in Python, with no dependencies, by someone working from the specification and the published public key rather than from the TypeScript.

33 conformance checks run on every build, and they are the reason this is a format rather than a library. A signature that only the library that produced it can check is not evidence; it is a formality. The Python verifier reaches the same verdict on the same bytes, including on the ones designed to fail.

[ The ascent ]

Eight layers, each resting on the one below. The status column is read out of the constitution when this page is generated, so a layer cannot be promoted here without being promoted in the document that governs it — and the build fails if a layer claims a file that does not exist.

  1. 1 Identity Every agent, model and human has one that survives restarts
  2. 2 Capability Authority is granted narrowly, expires, and is revocable centrally
  3. 3 Evidence Claims are checked against sources and reported as supported, unverified or contradicted
  4. 4 Trust Records accumulate into facts about behaviour — counts, never scores about people
  5. 5 Governance Policies, obligations, approvals and the workflows humans use to run all of it
  6. 6 Autonomy ABSuite's own agents watch the record continuously and raise what a person should see
  7. 7 Collective Intelligence Independent deployments verify each other's records without merging themaccrues with adoption — one mechanism is built and published, @absuitecore/notary, but the layer is the network, and the network needs deployments that are not ours
  8. 8 Civilization Millions of agents, autonomous economies, planetary-scale accountabilityaccrues with use — nothing here is a feature that can be written; it is what the lower seven become at scale

The last two are not late. They are not features that can be written at all — a network of deployments verifying each other needs deployments that are not ours, and the layer above it is what the lower seven become at scale. A roadmap that does not mark what is shipped is a wish list wearing an architecture diagram.

[ What it costs ]

Everything above this line is free, MIT, and stays that way — self-hosted, unmetered, every record kept forever, and you may run your own notary because that package is in this repository under the same licence. So it is worth being exact about what the paid plans sell, because a feature can never be the moat here: anybody may take this codebase, delete the quota check, run every tier and sell the result in competition. That is the deal the licence makes on purpose.

What cannot be copied is not code — it is being somebody else. A notary you run yourself gives you your own signature vouching for your own chain, which proves nothing to the auditor the exercise exists for. Nothing inside one deployment can close that gap, because everything inside it is signed by the same party. The paid plans sell witnessing by a party with no stake in the answer, and a fork cannot replicate it — a fork’s notary is equally self-interested toward its own users.

Free Free forever It works. The whole trust layer, self-hosted, unmetered, every record kept forever. Not a trial and not crippled. An unwitnessed chain is reported as UNWITNESSED, never as suspicious. unwitnessedrewrite window — We witness nothing for you. Run your own notary — the package is in this repository.
Team $49/mo $490/yr Somebody else saw it. Revocation that works across services rather than in one process, and an alert when the chain breaks. The first rung where the evidence stops being a claim about your own honesty. 24 hoursrewrite window — We counter-sign your chain head once a day.
Business $299/mo $2,990/yr It satisfies somebody who does not trust you. A year of records and an export an auditor verifies holding only a public key. The point where the records stop being your reassurance and become evidence. 1 hourrewrite window — We counter-sign your chain head every hour.

A chain witnessed hourly can be rewritten within an hour and no further; witnessed daily, within a day; never witnessed, for as long as you hold the key. That is one number a compliance officer can put in a document, and it is the line on this table a competitor cannot implement by copying code. An annual subscription is charged 10 months, so a year costs two months less than paying monthly. Enterprise is negotiated. Payment is through PayPal.

And there is a third path that is not on this ladder. Support this work is for readers who value the open-source side and want to back it once, without a subscription and without needing anything operated for them. It buys no tier and unlocks nothing — everything it would unlock is already free. A one-off gift and a monthly service are different decisions, and asking somebody to commit forever in order to say thank you once is how you get neither.

The prices on this page are read out of the code that charges them when it is generated, and the build fails if they drift — a running instance serves the same ladder at GET /plans. Nobody has bought anything yet and no hosted instance is running. That is stated here rather than left to be discovered, because a pricing table is the one place in this project where an unbacked claim would take somebody’s money.

[ What it refuses to be ]

Not features postponed. Permanent refusals, each one a thing a competitor will build, sell profitably, and be commercially right about. Each is held in place by a test that fails the build if the behaviour changes.

[ A hash chain is not a signature ]

Hash-chaining proves a record was not edited afterwards. It does not prove who wrote it — the operator being audited can build a perfectly valid chain containing anything they like. Ed25519 closes that gap: verification needs only the public key, and a public key cannot sign.

[ Read next ]