Key Takeaways
- Halo is an open-source project that records AI agent activity in an append-only, hash-chained log.
- The project is designed to make runtime evidence verifiable without trusting the vendor’s editable dashboards or audit logs.
- Halo’s own documentation stresses that it can prove integrity, but not completeness, unless a trusted outside witness is involved.
What happened
A Hacker News post introduced Halo, an open-source project from Brian, who said he previously worked at Vanta and began thinking about what compliance evidence might look like in a more agent-driven software world.
The pitch behind Halo is straightforward: if a company gives an AI agent access to internal data, it needs a way to inspect what happened at runtime. According to the project, standard vendor observability tools and audit logs may not be enough because they can be edited by the same party being evaluated.
Halo’s core idea is to create tamper-evident runtime evidence for agents. The project says it records actions such as tool calls, model calls, data access, and approvals into an append-only log. Each record is hash-chained so that later verification can detect whether a log has been altered.
The repository describes Halo as a reference implementation that includes a recorder, verifier, witness client, and report server. It is released under Apache-2.0 and is implemented in Python with zero runtime dependencies. The project page also points to a TypeScript version in a separate repository.
The project’s documentation provides a simple integration pattern: wrap an agent entrypoint with a tracing function, then generate a report from the resulting JSONL record file. It also includes a demo flow that creates a fictional vendor setup, serves reports, and lets users test tamper detection by modifying a log line and reloading the report.
Why it matters
Halo is aimed at a growing gap in AI governance: proving what an agent actually did, not just what a vendor says it did.
That distinction matters because the project argues that security questionnaires and audit workflows are increasingly asking for evidence about AI behavior. In that framing, a static explanation or screenshot is less useful than a runtime record that can be independently checked.
The project also tries to separate two different guarantees:
- Integrity: whether the log was altered after the fact.
- Completeness: whether all relevant actions were actually recorded.
Halo says its hash-chained log can establish integrity on its own, but not completeness. To address completeness, the project proposes an external witness that stores periodic fingerprints of the chain. The witness only receives a record count and a chain fingerprint, not the record contents.
That limitation is important. Halo’s own documentation notes that a self-held chain can still be incomplete if a vendor omits events entirely or deletes a problematic period before resealing the log. In other words, the system is built to make tampering visible, but it does not claim to solve every trust problem by itself.
The project also emphasizes implementation choices meant to reduce operational burden. It says raw inputs are not stored directly in records, arguments are hashed and redacted in summary form, and the runtime package relies only on the standard library. Halo’s docs describe redaction as best-effort defense-in-depth rather than a guarantee.
What to watch
The next question is whether Halo’s witness model can become practical outside the vendor’s control. The project says that proving completeness requires a party that holds periodic fingerprints independently, so adoption may depend on whether customers or third parties are willing to serve that role.
It will also be worth watching how the project’s open record format and adapters develop. The documentation says Halo can ingest records from OpenTelemetry GenAI spans and has a TypeScript package with native adapters for parts of the JavaScript agent ecosystem. If that interoperability grows, it could make the system easier to adopt across mixed stacks.
Finally, Halo’s usefulness will likely depend on how teams use it in actual security and compliance reviews. The project positions itself as evidence for audits and questionnaires, not as a certification or enforcement system. That means its value will hinge on whether assessors find the runtime reports credible and whether organizations are comfortable making log evidence part of their approval process.
For now, Halo is a clear attempt to turn AI agent behavior into something auditable, portable, and harder to rewrite after the fact.
