Attesto

Witness Plane

Witnesses, quorum, and fork visibility

The Witness Plane makes stream history harder to rewrite quietly. Witnesses sign monotonic checkpoint progression and emit fork evidence when they observe conflicting histories for the same stream.

Witnesses

A witness is an independent service with its own identity key and key epoch. It stores the last accepted checkpoint per tenant stream and only signs a new checkpoint when it extends the previous history.

RolePurpose
Attesto-operated witnessManaged witness for early production policies and baseline availability.
Customer-operated witnessCustomer-side view of checkpoint progression, commonly through Local Vault.
Assurance witnessIndependent assurance or auditor-operated witness for higher trust policies.
Partner witnessTrusted third-party witness used in customer-specific policy designs.

Privacy-preserving witness node package

The standalone witness package is defined as an observation node, not a consensus node and not a blockchain validator. It observes public or explicitly shared checkpoint heads, anchor epochs, release manifests, and truth-package hashes. It never receives customer payloads, envelopes, receipts, tenant metadata, or secrets unless a tenant explicitly shares a specific artifact.

Package names are attesto-witness, @attesto/witness, and go.attesto.eu/witness. The package must never be a transitive dependency of the core SDKs, must never auto-enroll, and must never start a background service without explicit user action. Until release evidence marks the standalone package green, customer-operated witness behavior is provided by Local Vault witness mode.

Quorum

Quorum describes how many witnesses must sign for a checkpoint to satisfy tenant policy. A managed-only policy can be useful for a simple stream. A 2-of-3 policy is stronger because the verifier can require agreement across multiple independent views. 

{
  "policy_id": "policy-2026-01",
  "required": 2,
  "witnesses": [
    "attesto-managed",
    "customer-local-vault",
    "assurance-witness"
  ]
}

Fork evidence and fork visibility

A fork is a conflict where two checkpoint heads claim incompatible history for the same stream. The witness must not hide this by picking one side. It records machine-readable fork evidence so the verifier can reject ambiguous history. 

{
  "kind": "fork_evidence",
  "stream_id": "str_...",
  "conflicting_checkpoints": [
    {"checkpoint_id": "chk_a", "checkpoint_head_hash": "hex-a"},
    {"checkpoint_id": "chk_b", "checkpoint_head_hash": "hex-b"}
  ],
  "detected_by": "customer-local-vault",
  "result": "verifier_rejects_ambiguous_history"
}

Public witness API shape