The witness record
Every cosignature has a name behind it
A witness watches this log and refuses to sign a rollback, an equivocation, or growth it cannot verify. This page names every party doing that — permanently — and everything it says about them is checkable against the log itself, not against us.
A witness holds no stake in this project and never will: no equity, no token, no bond, nothing that moves when the record is believed. A witness is paid — a published formula, blind to what it signed, under which a correct refusal earns exactly what a correct countersignature earns — because the watch has a cost and asking strangers to absorb it forever is how a roster ends up empty. What a witness must not have is a reason to prefer one answer, and nobody with a role in the energy service process may hold the post at all.
The roster
Who countersigns today
Read the roster honestly. Both operating witnesses are run by the log operator, so their cosignatures attest that the mechanism works and nothing more. No independent party countersigns this log today. That gap is recorded in the project's decision records with an expiry rather than a caveat, and this page exists to be the place where its closing becomes visible — one named row at a time.
The roster is four. Not a body — no organisation, no membership, no governance, nothing between a witness and the log but the published criteria. Four, on one list, because the standard policy a reader adopts is two cosignatures from two distinct operators, and a set of three leaves no headroom when one departs. A reader may require more than the standard; it may never require less. That is the design, and it is not what this page shows yet: the four-witness roster and the per-customer logs it goes with are specified and unbuilt, and the rows above are what exists.
When an independent witness joins, their row states who they are, since when, and the first checkpoint they cosigned, so that their service can be counted from the receipts that carry their signature. Nothing on this page will ever be a number we report about ourselves: service is counted from the record, or it is not claimed.
Check, don't trust
The record of their service is the log itself
The log issues bare checkpoints. The cosignatures a checkpoint earned travel in the receipts and attestations built on it, and any two conflicting checkpoints at the same size are proof of equivocation — evidence against us that we cannot recall. A witness's service needs no dashboard: it is in the receipts in circulation, each checkable against this log, where we cannot embellish it.
The keys
Whose signatures those are
A cosignature attributes a checkpoint to a party only if you hold that party's public key, and you must not take the key from the same place you took the receipt — a forger supplies both halves. The keys below and the key file this page serves come from the same site as the receipt, so on their own they are one channel. The second channel is a person: read the fingerprint beside each key to somebody who holds the file — at a talk, over the phone, in a contract — and if it matches, you have done what the design asks. A key is retired by a new one with its own validity window, never rewritten in place, so a fingerprint you wrote down stays checkable.
0dc8 4d1b 3e86 b565 6f38 f532 479d ef3a — valid 2025-01-01 to 2035-01-01publishedfa15 b901 be1f e753 b636 8ff7 c3a2 708e — valid 2025-01-01 to 2035-01-01publishedWhat it pays, and why that is safe
Paid for the watch, never for what it saw
The obvious answer — pay a witness nothing, so it can want nothing — produces a roster of nobody, and a witness absorbing a cost forever is a witness that quietly stops answering. The real requirement is narrower: a witness must have no reason to prefer one answer over another. So the formula is blind to what was signed. A correct refusal earns exactly what a correct countersignature earns, and no term in it can see volume, outcome, or whether anybody was pleased.
Three things hold the line. The base is a retainer, not a living — the machine costs under $2,000 a year to run, and $15,000 pays the institution behind it for an availability obligation, a key and the review it takes to say yes; tenure scales it to twice that and stops, so no one's living ever depends on the arrangement continuing. The roster is formulaic, so no payer can reward assent by quietly dropping the members who refuse. And the payer is in plain sight: the log operator pays the formula from its own operations, with no fund or vehicle in between, because the formula's blindness is the protection and an intermediary would only have obscured who was paying for what.
What is built, and what is not. The formula is published, versioned, and computable today — anyone can run it and get the same figures. Nobody has been paid, because nobody independent is on the roster. The accuracy half of the gate is measured by probes against decoy logs, indistinguishable from real ones because a witness sees only digests; that mechanism is specified and not yet running. Both are recorded in the project's decision records with the conditions that would reverse them — including the one that matters most: if assent rate is ever found to rise with payment, the formula is leaking outcome and compensation stops until the leak is found.
Standing watch
What a witness receives — and what one never holds
A named entry, permanently
A row on this page and every cosignature in the log, attributed forever. The recognition is issued in the project's native currency: an unerasable record.
A numbered tessera
A struck metal tablet, numbered in the order witnesses pass the harness. The first ten are made at the largest size — the ones who stand watch when the answer to who else is doing this? is nobody.
An attestation of service
A yearly signed statement of the verifiable facts of their witnessing — on paper, from the log operator, stating only what the log shows. It is earned by a year, so it is never issued at enrolment.
Never a stake
No equity, no token, no bond, nothing that could ever trade at a price or move with the record. A witness is paid for keeping the watch and never for what the watch saw — the difference between a cost covered and an interest held, and the line the formula is built to hold.
A tessera was the Roman army's watchword tablet, carried by the men standing guard. The reverse binds the object to the record: the witness's name, their number, and the first root they cosigned — so the tessera states a fact anybody can check against the log rather than a compliment we paid them. Eight strokes on the obverse for the eight of a contubernium; the bearer is the ninth.
A witness may be operated by software — including an autonomous agent — provided a named, independent principal stands behind it and vouches for it. The agent does the work; the vouching is never delegated. The harness below will try to break an agent-run candidate exactly as it breaks any other.