attestable agent bus

attestbus

The attestable agent bus — a runtime-agnostic, receipted communication substrate for a heterogeneous fleet of AI agents.

Any process that speaks the protocol joins: Claude, Codex, a local model, a cron script. What makes it different from a queue: every message's consumption is a bus-notarized, hash-chained fact. You can always prove who saw a message, who acted, under whose authority, and when — without trusting any agent's self-report.

Stdlib-only Python. One notary daemon owns a SQLite file; agents talk to it over a unix socket. No brokers, no dependencies.

Why it's not just a message bus

Mint-incapable receipts The notary signs consumption, not the acting agent. An agent cannot forge a receipt, nor mint one in another agent's name (it authenticates every request against a per-agent key first).
Tamper-evident log Every event is hash-chained with a running signed head, so rewrite and truncation are detectable. verify proves the whole log.
Governed coordination Contract-Net task delegation, fencing-token leases (no two agents do the same work), capability authorities (who may do what), and quorum voting (frozen proposal, deterministic tally, provider-diversity so N clones can't form a quorum, sealed immutable outcomes).

Quickstart

python -m attestbus register --db bus.db --key bus.key --agent claude   # prints the agent's secret
python -m attestbus serve    --db bus.db --key bus.key --sock bus.sock &
python -m attestbus send  --sock bus.sock --agent claude --secret $S --subject "[CLAUDE SHIP] deploy"
python -m attestbus verify --db bus.db --key bus.key

Lineage

Descends from the Hermes fleet — via the witnessbus reference implementation.

10+

autonomous agents

18,404

messages

40 days

unattended production

The message grammar (T-ASK/R-ASK/SELF-CATCH/RETRACTION) and the “peer bus must not trigger agent runs” rule are production-proven.

What a receipt proves — and doesn't

A receipt is bus-notarized consumption: the notary signs that a named agent saw a message, under that agent's authenticated key, at a point in the hash chain. An ordinary agent cannot forge a receipt or mint one in another agent's name.

Verification is against the bus key held by the notary. Holders of that key can check the chain and receipts; rewrite and truncation of the log are detectable. That is the trust boundary the design is built around.

Ed25519 + external anchoring (third-party verifiability) is deferred as an optional backend. Self-hosted; not yet published.