Halo: Open-Source Tool Creates Tamper-Evident Audit Logs for AI Agents

·1 views

A developer named Brian, formerly of compliance firm Vanta, has released an open-source tool called Halo that records every action taken by AI agents at runtime. The project addresses a growing accountability gap: when businesses deploy third-party AI agents on their data, existing audit logs are vendor-controlled and potentially editable. Halo works by capturing tool calls, model calls, and data access events into a hash-chained, append-only log that any party can independently verify. The lightweight Python library has zero runtime dependencies, spans roughly 4,300 lines of code, and is licensed under Apache 2.0, with a TypeScript version also available. Brian argues that traditional compliance frameworks like SOC 2 are ill-suited to agentic AI, where the same prompt can produce different actions each time, making runtime evidence the only reliable audit trail.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why a Single Email Check Belongs in Every Software Release Pipeline

Software release checklists typically verify APIs, queues, and UI functionality, but often overlook whether transactional emails — such as password resets or signup confirmations — are working correctly for the current environment. A developer writing on DEV Community argues that one focused, replayable email check should be part of every release gate to catch bugs like wrong hostnames, stale environment variables, or duplicate messages. The recommended approach involves triggering a single user-facing email flow, routing it to an isolated inbox, and asserting four things: exactly one message was sent, the subject and recipient are current, the call-to-action link uses the correct host, and the body copy is intact. Existing unit and integration tests fall short because they do not confirm that a live deployment produced the right email for the right flow at the moment of release. Structured log output — including run ID, recipient, subject, and extracted link host — is also advised so that failures are self-explanatory and easy to diagnose without extra context.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer picks PostgreSQL extension PGMQ over Redis for IoT sensor data queuing

A developer building CultivatorsLedger, a local-first cultivation telemetry platform, chose PGMQ over Redis, Kafka, and MQTT to handle unreliable WiFi and prevent sensor data loss in grow environments. PGMQ is a PostgreSQL extension that transforms an existing Postgres database into a message queue, eliminating the need for a separate messaging service. The ingestion flow works by sending sensor data via HTTP POST to a queue, where a lightweight Python worker reads, processes, and deletes each message after saving it to timeseries tables. If processing fails or the server restarts, messages remain in the queue until the visibility timeout expires, ensuring no data is lost. The developer acknowledges PGMQ cannot match Kafka at massive scale but argues it is sufficient for small facilities while reducing operational complexity by keeping everything within a single database.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches Free Open-Source App to Track Credit Card Perks and Deadlines

A developer has released Perks Reminder, a free and open-source web app designed to help users manage credit card benefits, welcome bonus deadlines, annual fee returns, and loyalty point expirations. The app avoids bank account integration, instead letting users manually enter and control their own card data, with email reminders sent before credits or points expire. A notable feature called Benefit Usage Manuals provides practical guidance on how specific credits trigger, which merchants qualify, and common redemption pitfalls. The latest update prioritized mobile usability, making expiring benefits more prominent and allowing faster completion actions on smaller screens. Built with Next.js, PostgreSQL, and Prisma, the app is self-hostable, and the developer is actively seeking community feedback on card data accuracy and reminder workflows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds LLM news filter that abstains when uncertain to cut false positives

A developer built a financial news filtering pipeline designed to prioritize silence over forwarding incorrect information, after observing that confidently wrong AI outputs posed real risks to decision-makers. The system uses a multi-stage chain of gates, starting with text normalization and hard regex rules, before passing items to a language model that is explicitly allowed to return an 'uncertain' verdict, which the pipeline treats as a rejection. Even confident model approvals are subject to a post-veto step that cross-checks any numbers or entities cited in the model's reasoning against the original source text. Because a low false-positive filter is quiet whether it is working or broken, the developer built an evaluation harness using a hand-labeled golden dataset to continuously measure performance. The project argues that for high-stakes filtering tasks, recall is an acceptable trade-off, and that an unmeasured filter is little more than a guess.

0 comments Read more at DEV Community