Halo – Tamper-evident runtime evidence for AI agents
Show HN: Halo – open-source, tamper-evident runtime evidence for AI agents
Halo is an open-source tool creating tamper-evident runtime records for AI agents, ensuring an audit trail that vendors cannot edit. It transforms every agent action, including tool calls and data access, into an append-only, hash-chained log verifiable by anyone without trust. With zero runtime dependencies and a focus on security, Halo allows developers to provide customers with a verifiable link instead of written assurances. It integrates seamlessly with existing stacks like OpenTelemetry, LangChain, and the Vercel AI SDK, offering a robust solution for compliance frameworks such as SOC 2 and the EU AI Act.
When a customer's security team asks 'what did your agent do with our data?', you hand them a link instead of a paragraph.
- derdi
> Disclaimer: this proves integrity, not completeness (as a self-held chain proves nothing was edited but does NOT prove that nothing was omitted).
Or as the page puts it in more detail:
> A self-held chain proves integrity: nothing was edited or reordered after the fact. It cannot prove completeness: the operator of a recorder can delete the bad day and re-seal the chain, or never write a record at all, and the chain stays internally consistent.
I don't get this. If I "hold" the "chain" (I hate the jargon agents invent), why can't I edit or reorder and then "re-seal" it?
- brian_kuan
PS: please try to break it - if you find that the report does not catch a deleted line, changed number, or modified record, I'd love to know!
And to start a discussion: if you sell or buy AI agent products, what do security reviews ask about them?
- mdellison
I've been working in the same lane. The vendor uses the same technique that academic preregistration uses in experiments. No audit firm/institution/organization needed. The customer just compares what was delivered against what was pre-committed. This way if something is off, it doesn't just show up as nothing... it shows up as a gap.