NoireBox — The flight recorder for AI agents

01 · THE CORE

One journal.
Nothing else matters. 🤘

The journal is the product: hash-chained, signed, append-only, anchored to an external witness. It doesn't know what an agent is — an event is a type and a payload. That's why it fits every agent, every stack, every language.

#1prev 000…05a5cb5a2…

→

#2prev 5a5cb5a2…b3fe86ad…

→

#3 ✗content rewrittenhash mismatch

→

#4prev ?chain broken

AI decision → SHA-256 → Ed25519 → TSA · RFC 3161 → ✓ immutable record

Hash-chained

Every event commits to the previous one. Insert, delete or rewrite — detected, and located to the exact event.

Signed

Ed25519 seals from a key that never leaves your infrastructure. A forged journal — even perfectly re-chained — fails.

Append-only

SQLite with no UPDATE, no DELETE. Writing is the only operation that exists. Signed events at 0.21 ms apiece.

02 · GUARDRAILS

Prevention is pluggable.
Proof is universal.

Already running Lakera, Llama Guard, your own LLM-judge or your own regexes? Keep them. A guardrail is just one event source — journal its verdicts and its catches become tamper-evident instead of living in rewritable logs.

Your guardrailits verdicts, as events

Your agentllm_call · llm_output · eval

Bundled pluginregex + 250 KB ML, fr & en

OpenAI Claude LangGraph CrewAI Custom agent → NoireBox → Immutable audit trail

No model lock-in. No infrastructure rewrite. One SDK.

The detector we ship is a working example of the plugin contract — swappable by design (ADR 003: Meta's Prompt Guard evaluated and declined, integration path documented).

03 · THE OUTSIDE WITNESS

Sealed at T. time ☕
The past is read-only.

A journal that dates itself proves nothing — that's the suspect writing its own report. RFC 3161 anchoring lets an external Timestamp Authority sign "I received hash X at time T". Only a 32-byte hash ever leaves. A regenerated journal shows a head the old token doesn't cover — and a backdated token is arithmetically impossible.

1

Hashonly the head, never the data

2

TSA signs« hash X received at time T »

3

Sealed backthe token becomes an event itself

One seal for the whole fleet. Certificate Transparency, for AI agents.

Fleet anchoring: the heads of N journals form a Merkle tree — a single TSA seal covers them all, and each box proves its place with ~11 hashes, verified offline. To our knowledge, no other agent-audit tool does this. make demo-fleet

make tsa → local OpenSSL witness, own key chain, 0 €, works offline. Or point NOIREBOX_TSA_URL at any qualified TSA.

04 · WHY NOW

AI decides faster than
you can audit it.

When something goes wrong — an incident, a dispute, a regulator — six questions decide everything:

What did the agent see?

What did it decide?

Which model version ran?

Which tools did it call?

What changed since?

Was the log modified afterwards?

NoireBox answers all six. Cryptographically.

05 · MEASURED, NOT CLAIMED

Numbers we can reproduce.
Not numbers we feel.

Every metric below is reproducible from the repo — make test, make train, the benchmark commands in the specs. A metric we can't reproduce means unknown, not a rounder number.

Metric	Value	Reproduce with
Sealed event — hash + Ed25519 + SQLite commit	0.21 ms	docs/SPECS.md §6
Guardrail scan, regex engine (7 lines)	0.23 ms	docs/SPECS.md §6
Guardrail scan, ML engine (7 lines)	10.4 ms	docs/SPECS.md §6
Full chain verification, 100 events	22 ms	verifier/verifier.py, any export
Bundled detectors, FR + EN	293 + 243 KB	make train · make train-en
Held-out attack sentences, FR + EN	12/12	tests/test_ml_guardrail.py
Test suite	91 green	make test

Measured on an M-series MacBook, September 2026. One number, one command — if a future release can't reproduce one, the table gets corrected, not inflated.

06 · THE PROOF

One file. One command.
Zero trust.

An auditor, a DPO, a client — receives the full dossier and recomputes the truth locally. No API to trust, no dashboard to believe. Arithmetic doesn't lie.

auditor@third-party — no credentials

07 · WHO IT'S FOR

Built for systems that
must explain themselves.

Finance

Every automated decision auditable — credit scoring, trading, claims.

Healthcare

Trace AI-assisted decisions end to end, for patients and inspectors.

Legal

Preserve evidence and chain of custody for AI-produced documents.

Enterprise AI

Know exactly what your agents did, on which input, with which tools.

Security

Detect log tampering, not just failures. The journal fights back.

Public sector

Algorithmic transparency duties, satisfied by design.

08 · DEVELOPERS

An API, an SDK, a verifier.
Nothing else to learn.

FastAPI, 10 documented routes, interactive OpenAPI at /docs. Record from anything that can send JSON — your agent, your CI, your cron job.

dev@yourstack — record & prove

$ git clone https://github.com/slabbdev/noirebox && cd noirebox
$ ./start.sh                            # tests + API on :8768 — /docs is live

$ curl -X POST :8768/api/v1/events \
    -d '{"type":"llm_call","payload":{"model":"gpt-x","prompt":"…"}}'

$ curl -X POST :8768/api/v1/anchors     # seal the chain head (RFC 3161)
$ curl -s :8768/api/v1/export > export.json

$ python verifier/verifier.py export.json
[✓] INTACT — proof, verified by anyone, offline

FastAPI OpenAPI · /docs Python SDK MCP server · 4 agent tools Docker 10 routes

09 · EUROPE

AI regulation is coming.
Make every decision traceable.

European AI vendors must prove — not promise — what their systems did. NoireBox is engineered around that obligation.

EU AI Act — art. 12

Record-keeping duties for risk systems: automatic event logs, cryptographic.

GDPR — 5(2) · 15/20

Accountability and subject rights: signed exports, verifiable by the DPO.

ISO 42001

AI management systems: traceability of decisions feeds the audit directly.

EU Data Act

Data access and governance: portable, verifiable records by construction.

Compliance isn't a feature. It's an architectural property.

Sovereign: self-hosted, zero telemetry, keys stay yours. Engineered in the Vosges 🇫🇷. A building block, not a certification — we state our perimeter (see the threat model) instead of overselling it.

10 · BEFORE YOU BEGIN

A few questions,
straight answers.

One NoireBox per agent?

Yes — like one flight recorder per aircraft. One instance = one SQLite file, one key pair, one chain. The fleet layer aggregates chain heads (32-byte hashes), never your events: your journal stays on your infrastructure.

Is this a blockchain?

No — one issuer, one verifier. A signed local chain gives integrity and non-repudiation without paying a consensus tax. The blockchain solves a problem we don't have (ADR 001).

How is it different from Langfuse or Helicone?

Those help developers debug what happened — the logs stay modifiable. NoireBox produces a dossier a third party verifies offline. Debug ≠ proof.

Do I have to use the bundled guardrail?

No — it's one event source among others. Keep Lakera, Llama Guard or your own LLM-judge and journal their verdicts with a single POST. The bundled detector is a working example of the plugin contract.

Do I need a paid timestamp authority?

No — make tsa runs a local OpenSSL witness with its own key chain: free, offline, sovereign. Pointing at any public or qualified TSA is one environment variable.

What does it cost?

Core: MIT, $0 forever, verification included. Cloud: from €49/mo when it ships. Enterprise: custom — HSM custody, qualified timestamps, SLA.

11 · START FREE

Core is MIT.
Forever.

Journal, guardrail plugin, verifier — free and open, including verification. A managed, EU-hosted offering is being shaped for teams who want the proof without running it.

Core

$0 · MIT forever

Self-hosted. Unlimited events. Journal, plugin, verifier.

Cloud

from €49/mo

Managed EU journal + guardrail + DPO-ready exports.

Enterprise

custom

SLA, SSO, HSM key custody, qualified timestamps, compliance support.

Early stage — pricing indicative, shaped with early-access partners.

One journal.Nothing else matters. 🤘