QWitness
Portable signed evidence and independent verification for onchain AI agents.
Demo
About
QWitness turns live onchain research evidence into portable, independently verifiable JSON receipts. Its shared TypeScript core queries The Graph for Aave V3 USDC and DAI reserves on Ethereum, calculates utilization with exact integer arithmetic, attaches structured deterministic analysis, and signs the complete canonical protected header and payload with ML-DSA-65. The public web flow and an actual MCP SDK client have successfully acquired live data, created receipts and verified them with a separately supplied signer pin. The Tamper Lab detects altered values and claims, and distinguishes a mathematically valid signature from an unexpected signer. Bundled HTML and Node verifiers work offline. This targets reusable AI tooling; deterministic analysis is labelled and no actual LLM call is claimed. Signatures do not prove provider honesty, analysis correctness or quantum resistance of Ethereum. The prototype is unaudited. The participant approved the review and reported no issues. Human narration and final submission remain pending.
How it's made
Created in a new repository using TypeScript, Next.js, React, the official MCP SDK, canonicalize and @noble/post-quantum 0.7.1. The bounded Graph adapter pins the Aave V3 reserve query to one indexed block and retains query text, variables, responses and deployment metadata. Token amounts remain integer/decimal strings. Actual provider responses revealed that number-pinned _meta can omit optional hash and timestamp; these stay unknown while conflicting known metadata, deployment IDs and block numbers are rejected. Web and MCP call the same acquisition, analysis and signing service. The complete canonical protected header and payload are signed with ML-DSA-65 and domain separation. Independent signer fingerprints establish the chosen trust input; embedded keys are not automatically trusted. All 77 unit tests and CI pass. Live Graph, real MCP client issuance and public browser tampering/key-substitution checks have succeeded. Codex assisted the specification, implementation, tests, documentation and video preparation. The participant supplied the AI-assisted brief, completed account connections and performed Graph key regeneration. The participant approved the review and reported no issues; no detailed manual-test observations are inferred. A 170.5-second live recording and clearly labelled synthetic-voice review were generated. Human narration is still required for the submission video.