Developer builds tamper-evident audit trail system for AI agent decisions

·3 views

A backend engineer has released NoireBox, an open-source tool designed to create cryptographically verifiable, tamper-evident logs of AI agent actions and decisions. The system uses SHA-256 hash chaining, Ed25519 signatures, and RFC 3161 trusted timestamps to make retroactive alteration of records arithmetically detectable. For deployments running multiple agents, NoireBox aggregates individual chain heads into a Merkle tree sealed with a single timestamp authority, a model borrowed from the Certificate Transparency system underpinning HTTPS. The tool is positioned as a compliance and accountability layer rather than a replacement for existing AI safety or observability solutions, allowing organizations to cryptographically prove what an AI agent did or decided at a specific moment. NoireBox is released under the MIT license and includes a standalone offline verifier that any third party can run independently to validate exported logs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Prism ML Bonsai 2 27B Squeezes Qwen3 into 5.9GB, but Benchmarks Have Caveats

Prism ML released Bonsai 2 27B, a ternary-quantized version of the Qwen3 27B model compressed to just 5.9GB — roughly one-ninth of the original size — using 1.76-bit-per-weight encoding. The company claims the model retains 98.2% of the original's aggregate benchmark score, with math and coding performance largely preserved, though visual reasoning showed the steepest drop. Independent analyst Kaitchup raised concerns that the 98.2% figure is based on average scores and may not reflect real-world multi-step tasks like agentic coding, where small errors compound. Benchmarks were also run on a full-precision model via vLLM on H100 GPUs, not on the compressed GGUF files users would actually run locally. On the hardware side, the smaller file size translates to roughly 9x faster token generation, with an RTX 5090 outpacing even the H100 at 129.9 versus 113.9 tokens per second at batch size 1.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Algolia API Bug Inflated HN Comment Count 100x, Skewing Market Research Data

A developer running an automated research loop discovered that the Hacker News Algolia search API returns wildly inaccurate comment counts when queried over 7- or 30-day windows, with the 'exhaustiveNbHits' flag silently set to false. The actual 30-day comment volume was 317,984, roughly 100 times lower than the API's reported figure of 34,795,481. The error went undetected for 89 automated cycles because no warning or error is raised by the API. The developer found the fix was to query one day at a time, as 24-hour windows consistently returned exhaustive, accurate results. The inflated denominator had been distorting product demand analysis, and once corrected, the true signal in the data proved far weaker than assumed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Pre-Commits Pass Criteria to Git Before Testing Claude Code AI Skills

A developer built three Claude Code skills for AI product managers and, before running any evaluations, committed the pass criteria to a Git repository to prevent post-hoc goal-shifting. The first evaluation run failed, revealing a flaw in the /build-or-not skill, which confidently recommended against building a feature despite having no evidence to draw on. A single rule fix — 'no sample, no decision' — resolved the issue, and the second run passed all gates. Testing the /agent-trust-review skill took four runs, with every failure traced back to errors in the test setup rather than the model itself. Across eight test cases and three runs each, the custom skills consistently outperformed plain Claude on structured refusals and pre-defined decision criteria, at a total cost of roughly $2 per full run.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why MPC Threshold Signing May Be the Safest Way for AI Agents to Handle Payments

A surge of AI agent payment infrastructure funding — including $30M raised by Catena and $35M by Sapiom — has highlighted a critical architectural gap: existing payment systems were built for humans, not autonomous software. When AI agents need to pay for services like API calls or cloud compute in milliseconds, traditional methods such as manual approvals and multi-signature wallets are too slow to be practical. Giving agents direct custody of private keys is fast but dangerous, as a recent fake AI trading bot incident demonstrated how easily such systems can be exploited. Multi-Party Computation (MPC) offers a middle path by splitting a private key into shares held by separate parties, so no single point of compromise can drain a wallet. This approach enables sub-150ms transaction signing without the agent ever reconstructing the full private key, though enterprises must still layer on spending limits and allowlists to maintain adequate controls.

0 comments Read more at DEV Community