Witness network · Node kit

Run a witness node

A witness is an outside party who fetches the ledger, checks it independently — every hash, every chain link, every anchor — and cosigns the block headers it has verified. Witness-in-a-box makes that one command: a single zero-dependency Node file. No permission, account or payment is needed to witness, and that is what makes the attestation mean something.

One command

Verify the file, make a key, register, and run a full witness pass — verify the chain, check the anchors, cosign, and write your own public record:

curl -sO https://www.a2ally.com/cli/witness-in-a-box.mjs && sha256sum witness-in-a-box.mjs
node witness-in-a-box.mjs keygen --key witness.pem
node witness-in-a-box.mjs register --domain <your domain>
node witness-in-a-box.mjs run --domain <your domain> --key witness.pem

run fails closed: if the chain does not verify, it exits non-zero and signs nothing. Add --every <minutes> to keep it running, or use an always-on shape below.

Verify before you install

SHA-256 of the exact artifact: 5ef2c53e30c927a3d7ef034375aedab7b989eace613a475fd0b943624c7682c5 — the same hash is served independently at /cli/witness-in-a-box.sha256, so you can pin it from two paths before running anything. Download: /cli/witness-in-a-box.mjs. Machine-readable manifest: GET /v1/node/kit.

What's in the repo kit

The kit lives in the repository at integrations/witness-in-a-box and ships as one package:

• witness-in-a-box.mjs — the kit itself: Node 18+, none (zero-dependency single file).
• README.md — the full guide, including the health endpoint and what the kit never does.
• SHA256SUMS — the published hash of the artifact, checked against the file above.
• The always-on shapes below, so the same file runs unattended.

Always-on

• systemd: witness-in-a-box.service — edit the domain, key path and working directory, then enable the user service.
• launchd: com.a2ally.witness.plist — edit the same fields, copy to ~/Library/LaunchAgents/, load it.
• cron: witness.crontab — one line running a single pass hourly; cron is the loop.
• Docker: Dockerfile plus the compose file in the kit folder — build the image, put witness.pem in ./data, set your domain, compose up.

Join in four steps

1. Download and hash-compare. Fetch the kit and check its SHA-256 against both published values before running anything.
2. Make a key and publish it. node witness-in-a-box.mjs keygen --key witness.pem, then put the printed public key at https://<your domain>/.well-known/a2ally-witness.pem. Your private key never leaves your machine.
3. Register. node witness-in-a-box.mjs register --domain <your domain> — the platform fetches your public key. The guided version of this path is the join page.
4. Run. node witness-in-a-box.mjs run --domain <your domain> --key witness.pem — one pass, or always-on with a shape above. See who is watching now at the witness network.

Managed node

Cannot self-host? For customers who cannot self-host, a2ally runs the witness node for them; no price is published for a managed node and nothing is charged today — registering interest only asks for pricing news. Register founder managed-node interest on the pricing page — pick “Managed witness node” in the form there, or post the same interest to POST /v1/pricing/interest with feature managed_node. Interest registered so far: 0. No price is published for a managed node and nothing is charged today.

Counters are live-computed from the public witness record on every read. A witness counts toward finality only when confirmed unaffiliated: affiliated, unconfirmed, pending and challenged witnesses never count. Machine-readable version of this page: markdown · JSON manifest.