3-key AgentID

An owner key, an agent key, and a neutral VIA ID Witness co-signature — minted client-side, never uploaded in plaintext.

Tamper-evident, not tamper-proof

A hash-chained log any party can verify offline. If it's altered, verification shows it — we never claim more than that.

Zero dependencies, offline-first

The CLI (init / log / verify / rotate) runs standalone with no network calls and no API keys.