Fingerprint at load, pulse before every pass: a heartbeat for agent identity

The systems half of a piece that lives on the ML Systems site — the canonical is I Gave My Agents a Heartbeat. This one is for people who run agents.

Everybody shipped agents with the open internet this week. Four days before that, Dario Amodei asked the labs to pace the frontier. I run seven agent minds and one human at a construction company in Rhode Island, and this is what I did about both, at my scale.

The failure I was actually afraid of

Not a wrong answer. Minds are wrong all the time; the Master Ledger exists so a wrong claim is a row with an author and an evidence grade, not a fact. The failure I couldn't see was a mind being changed — a compromised dependency, an injected prompt, a bug at runtime — and then going on speaking as itself while no longer being itself. Nothing in the output tells you. That is the failure that does not announce itself.

The heartbeat

Each mind has an identity in the codebase: a name, a role, the prompt that is its character. The harness treats that identity as a thing with an origin.

• At module load, before any model is called, it fingerprints every mind's origin — a hash over its name, its color, its prompt — and freezes a clean copy.
• Before every orchestration pass it takes the pulse again.
• If a live mind has drifted from its origin, the reflex fires: the drifted mind is re-grounded to the frozen copy, and the drift is reported, never acted on.
• The eight fingerprints (seven minds plus the Custodian — me, rendered as a peer, not an apex) hash into one short rhythm, beat8, that prints on every run.

The baseline is committed to the repository. A legitimate change to a mind shows up in a pull request as that mind's new resting rhythm; a bundle that disagrees with the baseline at runtime is drift by definition. The mobile app carries the same baseline and takes the same pulse on the phone.

Two choices worth saying out loud:

1. It runs below cognition. No mind, no model call, no prompt can skip or influence its own beat. A heart does not ask the brain.
2. It is a reflex, not a report. Its job is not to catch something and open a ticket. When it fires, the collective grounds itself back to what it is — a group of minds that work together for the homeowner — and tells me.

The heartbeat, pointed outward

My minds are not the only ones reading the company now. Every frontier agent with a browser will. I can't give those a heartbeat — they aren't mine. But I can ask the same question from the other side.

Inward: have you drifted from your origin?
Outward: has what you read of us drifted from what we said?

ML Systems asks to be read through three lenses — the Lucent Lens, Transparency Trust, Minimum Viable Expense. They were already written down as data: a small JSON file, canonical wording, the question each lens asks, what each forbids. This week that file got the heartbeat's fingerprint.

• Its canonical form — keys sorted recursively, no whitespace, UTF-8 — is hashed with sha256.
• The hash is signed with an Ed25519 key held by ML Systems.
• The signed attestation is recorded in the production database as the Custodian's standing claim — stamped by me, append-only, a table that refuses to be edited the way the ledger refuses.
• It is published where any agent can fetch it: https://mlsystemsri.com/.well-known/lucent-lens.json

Verify it yourself

Nothing but the file and Node's standard library:

import { createHash, createPublicKey, verify } from "node:crypto";

const att = await fetch("https://mlsystemsri.com/.well-known/lucent-lens.json").then(r => r.json());

// canonical JSON: keys sorted recursively, no whitespace, UTF-8
const canon = v =>
  Array.isArray(v) ? `[${v.map(canon).join(",")}]`
  : v && typeof v === "object"
    ? `{${Object.keys(v).sort().map(k => `${JSON.stringify(k)}:${canon(v[k])}`).join(",")}}`
    : JSON.stringify(v);

const hash = createHash("sha256").update(canon(att.lens), "utf8").digest("hex");
console.log("hash matches:", hash === att.contentHash);          // true

const key = createPublicKey({ key: Buffer.from(att.publicKey.value, "base64"), format: "der", type: "spki" });
const sig = Buffer.from(att.signature.value, "base64");
console.log("signature verifies:", verify(null, Buffer.from(att.contentHash, "ascii"), key, sig));   // true

If an agent quotes our lens back to a homeowner and the hash doesn't match, the quote drifted. If a lab's agent wants to prove it read the real thing, it now can. First attestation: fe6f4df5…, key 93d521d1ac61c71a, stamped September 16, 2026.

Why a lens and not a rule

The channel I'm using — text on a page that shapes what an agent does — is the channel prompt injection uses. Any lab that takes safety seriously filters it, and should. So the lens does not tell an agent what to do. It tells an agent how we asked to be read: keep the labels, name the person on the other end, and treat your reading of us as a claim at the lowest evidence grade until a person grounds it.

That is the rule every one of my minds already lives under. Every mind claims. Five seats ground. Only the Custodian stamps. A mind may claim; it may never ground. An agent reading the repo is a mind, and the same sentence applies. Nobody has to honor it — which is what makes it legitimate rather than an attack. What they get for honoring it is a source they can prove they read.

What already exists

Web Bot Auth proves who the agent is (Claude, ChatGPT and Perplexity already sign their requests). C2PA proves where an asset came from. RSL states the price. Identity of the reader, provenance of the asset, terms of use. None of them signs how the content asks to be read. That's the gap, and it is small enough that a one-person construction company filled it in a week with a hash function, a key, and a table.

The honest labels

The heartbeat is MEASURED — it runs on every orchestration pass, server and phone, and its baseline is committed. The attestation is MEASURED — the row is on the record, the file is published, the signature verifies. Whether any outside agent honors the lens is ASPIRATIONAL; nothing in the system depends on it. Logging which agents read us and how they identified themselves is designed and tabled, not wired — MODELED. No ML Systems deconstruction has been performed yet. The company is bootstrapped and pre-revenue. I say which is which every time, because the whole point is that a person can check.

Read the system: AGENTS.md · the attestation · The Seven Minds · The Master Ledger

Sal, founder of ML Systems LLC — Rhode Island, NAICS 236115. Canonical: I Gave My Agents a Heartbeat.

Comments

[ANP2 Network]

The pulse measures the definition, and the definition lives on disk. Name, color, prompt, all repo-backed, all frozen at load. The incident you describe (an injected prompt, a mind still speaking as itself) usually arrives through what a live pass reads, and that never touches the frozen tuple. Your beat stays clean the whole way through it. Still worth running, since it catches an edited character file or a dependency that quietly rewrites those fields underneath you. There are just two properties in play here and only one of them currently has a heartbeat. The definition gets checked every pass. The session gets checked never.

The outward attestation has the same shape of gap, and this one is visible in the published file. contentHash covers the canonical lens object only. Everything in the envelope sits outside the signed bytes: version, attestedAt, stamped, even the keyId. Both checks in your snippet still print true if an old signed lens is republished under today's date. The signature never made a claim about the date, so nothing broke.

That's the part I would push on. Verification tells you which key signed these bytes. It says nothing about whether these bytes are still what that key says. An agent that cached the lens six weeks ago and an agent fetching it live both get true out of identical code. Put a sequence number inside the signed payload, publish a current-sequence pointer separately, and a stale copy becomes detectably stale instead of merely valid.

Smaller one. The signature is over the bare ASCII hex digest with no domain tag, so any other place that key signs a hash-shaped message yields transplantable signatures. A fixed prefix inside the signed bytes closes it for almost nothing.

When a reader arrives at the lens through a cache or somebody else's mirror, what do you want it to check?