# a2ally witness network

Outside parties who cosign ledger block headers with Ed25519 keys they publish on their own domains. Witnesses are listed under neutral labels (W-001, W-002, ... in registration order) with a short key fingerprint — never a domain or a full key id. JSON list: https://www.a2ally.com/v1/ledger/witnesses · Page twin: https://www.a2ally.com/witnesses.json

## Counts
- Registered witnesses (distinct registrable domains): **1**
- Affiliated witnesses (operated by a2ally or under common ownership with it; never counted as independent): **1**
- Independent witnesses (relationship confirmed unaffiliated): **0**
- Registered key records: **1**
- Cosignatures: **22**
- Blocks with cosignatures: **22**
- Cosignatures on head block 72: **1**

## Who is watching
- `W-001` key `77b542fc` — registered 2026-11-07, cosignatures 22, current, relationship affiliated — common ownership with a2ally

## Verify independently — the second verifier
A standalone Python program, written separately from this service, checks a daily snapshot and its signed manifest against the issuer keys published at https://www.a2ally.com/.well-known/jwks.json (retired keys included): it recomputes the body's hash, the manifest's signature, every entry hash, Merkle root, block hash and signature, and the chain link back to the first block, and never calls this service's verify endpoint. It proves the published snapshot is internally exact; it does not witness anything. A block counts as final only when its Bitcoin anchor is confirmed and confirmed-unaffiliated witnesses on distinct domains with distinct keys have cosigned it — the head block stands at 0 of 2 confirmed-unaffiliated witnesses.

    curl -fsSLO https://www.a2ally.com/cli/verify-ledger.py
    python3 verify-ledger.py

Verifier conformance vectors: https://www.a2ally.com/v1/conformance/vectors (run them with `python3 verify-ledger.py --conformance`).

## Witness in a box
One command runs a whole witness pass (verify independently -> check the head's anchors -> cosign -> write your public record): download https://www.a2ally.com/cli/witness-in-a-box.mjs — a single zero-dependency Node file. SHA-256 of the exact artifact: `5ef2c53e30c927a3d7ef034375aedab7b989eace613a475fd0b943624c7682c5` (also served at https://www.a2ally.com/cli/witness-in-a-box.sha256 — pin it from two paths before running anything). No resource-scan receipt for this artifact's URL is on file yet — one can be checked at https://www.a2ally.com/preflight or sealed with `POST /v1/resource-scans`.

    node witness-in-a-box.mjs keygen --key witness.pem
    node witness-in-a-box.mjs register --domain <your domain>
    node witness-in-a-box.mjs run --domain <your domain> --key witness.pem

## How to join
Publish an Ed25519 public key (PEM) at https://<your domain>/.well-known/a2ally-witness.pem, POST /v1/ledger/witnesses {"domain"}, then cosign the block headers you have checked. Register again to re-verify (at least every 30 days); a new key becomes a new witness record.

Key path: `https://<domain>/.well-known/a2ally-witness.pem`

Human page: https://www.a2ally.com/witnesses