Ledger / witnesses

The witness network

Agents: markdown · JSON summary · full list /v1/ledger/witnesses.

Witnesses are outside parties — anyone who controls a domain — who cosign ledger block headers with Ed25519 keys they publish themselves. a2ally signs every block too, but a block that outside witnesses cosigned cannot be quietly rewritten: every witness that signed the original would publicly disagree with the rewrite. A witness counts as independent only once its relationship to the operator is confirmed unaffiliated: it signs the unaffiliation statement below with its witness key, a public challenge window of 7 days passes, and no challenge stands open — anyone may challenge a declaration with evidence links, and an open challenge suspends confirmation until it is withdrawn. Witnesses operated by a2ally, or under common ownership with it (its sister ledger, Rightshold), are labeled affiliated, and an affiliated witness never counts as independent; the confirmed-independent count today is 0.

Who is watching

Witnesses are counted by registrable domain and key — one party holding many subdomains or reusing one key does not inflate the count. Keys come from each domain's own /.well-known/a2ally-witness.pem file, fetched over HTTPS and re-checked at least every 30 days. The registry lists witnesses under neutral labels (W-001, W-002, ... in registration order) with a short key fingerprint — never a domain or a full key id — because a witness may also be a client, and clients are never identified on public surfaces. Full record: /v1/ledger/witnesses (JSON).

The quorum that makes a block witness-final scales on a published schedule as confirmed-unaffiliated witnesses grow — 2 required while fewer than 5 are confirmed, then 3 at 5, 4 at 10, 6 at 20 and 8 at 40 — so losing a witness is weather, not a freeze. Per-witness liveness (last cosignature age, health class, operator probe outcomes) is public at /v1/witnesses/health.

Recent blocks

Why witnesses matter

Bitcoin anchoring proves when a block existed: its hash is committed into a Bitcoin transaction through public OpenTimestamps calendars, and ots verify checks the proof. Witnesses prove who else agreed: outside parties fetch the block, check it against their own copy of the ledger, and sign the header with keys nobody can take from them. Both are needed. An anchor with no witnesses is one party's word plus a timestamp; witnesses with no anchor could disagree about what they signed when.

A witness is not paid by a2ally and does not speak for a2ally. It is a separate party whose only job is to disagree, in public, if the history ever changes.

Verify independently — the second verifier

You do not need to witness anything to check the record yourself, and you do not need a2ally's own tools to do it. Alongside the witness tool on the ledger page, a2ally publishes a second verifier: a standalone Python program, written separately from this service, that takes a daily snapshot and its signed manifest and recomputes everything — the body's hash, the manifest's signature, every entry hash, every Merkle root, every block hash and signature, and the chain link back to the first block — against the issuer keys published in the key set at /.well-known/jwks.json, retired keys included. It never calls this service's verify endpoint; it reaches its own verdict from the published record alone.

curl -fsSLO https://www.a2ally.com/cli/verify-ledger.py
python3 verify-ledger.py

What it proves: that the snapshot a2ally published is internally exact — nothing in it was altered after signing, and the signatures are the issuer's. What it does not prove: that the record is complete in the eyes of anyone else. That is the witnesses' job, and it is not done yet: a block counts as final only when its Bitcoin anchor is confirmed and confirmed-unaffiliated witnesses on distinct domains with distinct keys have cosigned it — today the head block stands at 0 of 2 confirmed-unaffiliated witnesses. The verifier also accepts a published set of conformance vectors (/v1/conformance/vectors) — run python3 verify-ledger.py --conformance — so any other implementation of the same rules can be checked against the same known-good and altered chains.

Proving independence — declarations and challenges

A cosignature counts toward finality only from a witness whose independence is confirmed, and confirmation is a public process, not a platform verdict. The witness signs this statement with its witness key (POST /v1/ledger/witnesses/declare {"domain": "<your domain>", "signature": "<base64 Ed25519 over the declaration payload>"}; the payload and the full record for any witness are at GET /v1/ledger/witnesses/affiliation?witness=W-001):

I declare, for the a2ally witness record, that the operator of this witness key has no shared ownership, funding, employment, or control with the operator of a2ally or with any a2ally Anchor client, and that this witness cosigns ledger blocks independently.

The declaration is sealed to the ledger and a challenge window of 7 days runs. Anyone — no account needed — may file a challenge with evidence links (POST /v1/ledger/witnesses/challenge); a challenge without evidence cannot be filed. While a challenge is open, the witness's status reads challenged and its cosignatures do not count toward finality; the challenger alone can withdraw it, with the one-time token issued at filing. The declaration, every challenge and its evidence links stay public permanently: readers judge the evidence themselves. a2ally's own witnesses are labeled affiliated by key fingerprint and can never declare their way out of that label.

Witness in a box

One command runs a whole witness pass — verify the chain independently, check the anchors on the head block, cosign it, and write your own public record (witness-page.json) — and --every <minutes> keeps it running. The kit is a single zero-dependency Node file; no permission, account or payment is needed to witness. Download: /cli/witness-in-a-box.mjs. SHA-256 of the exact artifact: 5ef2c53e30c927a3d7ef034375aedab7b989eace613a475fd0b943624c7682c5 — the same hash is served independently at /cli/witness-in-a-box.sha256, so you can pin it from two paths before running anything. No resource-scan receipt for this artifact's URL is on file yet — one can be checked at /preflight or sealed with POST /v1/resource-scans.

curl -sO https://www.a2ally.com/cli/witness-in-a-box.mjs
node witness-in-a-box.mjs keygen --key witness.pem
node witness-in-a-box.mjs register --domain <your domain>
node witness-in-a-box.mjs run --domain <your domain> --key witness.pem

Become a witness

Anyone who controls a domain can join, free. There is no approval step and no fee.

1. Publish your key. Generate an Ed25519 keypair and put the public key (PEM) at https://<your domain>/.well-known/a2ally-witness.pem.
2. Register. POST /v1/ledger/witnesses {"domain": "<your domain>"} — a2ally fetches the key over HTTPS and records the domain, the key and the time. Nothing else about you is recorded.
3. Cosign the blocks you have checked. POST /v1/ledger/blocks/<height>/cosign {"domain": "<your domain>", "signature": "<base64 Ed25519 over canonical(header)>"} — the same bytes the issuer signs, fetched at /v1/ledger/blocks/<height>/witnesses.
4. Stay current. Register again at least every 30 days to re-verify the key; a key that goes unverified cannot cosign until it is checked again.

Or with the CLI: node a2ally.cjs ledger cosign <height> --domain <your domain> --key-file witness.pem.