// noirebox.eu — press & media kit. Every figure on this page is checkable in the public repository.
Press kit v0.23.0
NoireBox is the flight data recorder for AI agents: an open-source,
tamper-evident journal where every decision an agent takes is sealed, signed and
time-stamped by external witnesses — and anyone can verify the record offline,
without trusting the operator.
Copy-paste ready. The ⧉ button copies each block verbatim.
One line
NoireBox is the flight data recorder for AI agents: a tamper-evident, signed, externally time-stamped journal that anyone can verify offline — without trusting the operator.
Short — ~65 words
NoireBox is an open-source (MIT) black box for AI agents. Every decision an agent takes — model call, tool use, verification event — is sealed into an append-only journal: hash-chained with SHA-256, signed with Ed25519, anchored to external RFC 3161 time-stamp authorities. A standalone verifier lets an auditor, a DPO or a client re-check the whole record offline, without trusting the operator. Built in the Vosges, France.
Long — ~150 words
NoireBox is an open-source black box for AI agents, built solo in the Vosges, France, and published under the MIT licence. It answers one question: if someone contests a decision made by an AI agent tomorrow, who can prove what the agent exactly did — and that the record has not been touched since? Observability tools are built for debugging, and their logs stay editable by whoever holds the disk. NoireBox seals every event into an append-only journal that is hash-chained (SHA-256), signed (Ed25519) and anchored to external RFC 3161 time-stamp authorities, then exports an attestation a third party verifies offline, without trusting the operator. It is the integrity layer that the EU AI Act (art. 12, automatic logging) and the GDPR (art. 5(2), accountability) assume but do not specify. Since 19 September 2026: 21 releases, 428 automated tests, 28 public architecture decision records — each with the alternatives it rejected.
What it does
Seals every agent event — append-only, no UPDATE, no DELETE; 0.17 ms per sealed event
Localizes falsification — rewrite, insert, delete are detected at the exact event
Non-repudiation — Ed25519; the key can live off the agent's disk (key-holder daemon, HSM/PKCS#11)
External time — RFC 3161 multi-TSA anchoring + OpenTimestamps (Bitcoin); only 32-byte hashes leave the machine
Guards the transcript — 3 engines (regex, trained micro-models, local LLM judge), detection in French and English
Names every unprovable state instead of merging it into an OK
What it is not
Not a blockchain — one issuer, one verifier, no consensus tax
Not observability — debugging is not proving
Not a certification — a component that states its own scope (threat model)
Not SaaS — self-hosted, zero telemetry, one SQLite file per journal
Not a truth oracle — it proves a record was not altered and when it existed; a proof tool, not a talisman
The question. Your AI agent writes meeting notes that bind your clients, signs purchase orders, files tickets. Eighteen months from now — who can prove what it exactly produced, on which input, with which tool, and why?
The gap. Today's answers — application logs, databases, git histories, agent observability dashboards — share one flaw: they are editable by whoever holds the disk, and the operator can always re-sign. The EU AI Act requires automatic event logs for high-risk systems (art. 12) and the GDPR requires demonstrable accountability (art. 5(2)); neither says how a log proves it was not edited afterwards. No logging-integrity standard is published yet.
The answer. Apply the Certificate-Transparency model to agent journals. NoireBox seals events into an append-only SQLite journal, hash-chained and Ed25519-signed, and periodically anchors the chain head to independent time witnesses (RFC 3161 authorities, OpenTimestamps/Bitcoin). The verifier is a standalone script: an auditor recomputes the whole chain offline, without access to your server, your keys or your trust.
The scope, stated up front. NoireBox proves a record was not altered and when it existed. It does not prove the record was true when written. Every state it cannot prove is named — undecidable is a first-class outcome, never folded into a green check.
Four angles that work, each with the sources a journalist can check in public.
1 — The black box, literally
Interpretability research asks why a model answered as it did — and the field itself warns that a model's self-explanation can be generated after the fact. NoireBox does not open the model. It seals what happened around it — what was asked, what came back, which tool ran, who judged the output and against which specification — and makes that record provable to a third party. The AI Act requires that second kind of transparency now, including where the first remains out of reach.
Sources: ART12-MAPPING.md, COMPLIANCE-EU.md, decision receipts (ADR 028 in ADRs.md).
2 — AI agents' logs are editable — and the AI Act demands logs
The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) set the high-risk (Annex III) obligations — including art. 12 logging and ≥ 6-month log retention — for 2 December 2027. It did not defer art. 12 or GDPR art. 5(2). Fines reach €35 M or 7% of global turnover. And no standard yet says what "integrity of logs" means — a solo developer shipped a working answer under MIT, fourteen months before the deadline.
Sources: COMPLIANCE-EU.md (verified against consolidated texts, cross-checked 17 Oct 2026), ART12-MAPPING.md, the essay "The AI Act went live two months ago. Your agent's logs are still editable."
3 — Audited in public, by its critics
The project applies "proof, not promises" to itself. Unix veteran Randal L. Schwartz published a catalog of attacks on AI coding-agent gates; NoireBox replayed it as tests in the open — five attack fixtures, sixteen tests, the caught attacks visible in the test names and the gaps named in code rather than smoothed over. Schwartz then named the underlying principle "Sam LABBE's Corollary": two engineers, two stacks (Unix primitives vs cryptographic ledgers), the same four defenses. An independent reviewer on dev.to re-ran the verifier release after release; each finding became a shipped answer within days, and the full audit of v0.20.0 — ten findings — was answered publicly, point by point.
Sources: test_scar_replay.py, SCAR-BENCH.md, AUTHORITY-LADDER.md, "Ten findings, ten answers".
4 — A proof tool, not a talisman
The rare story of a product that states what it cannot do. NoireBox proves integrity and existence-in-time; it refuses to vouch for truth. Twenty-one releases in one month, every architectural decision public — twenty-eight ADRs, each with what was rejected and why — and the whole method MIT-licensed, because the maker's position is: the journal stays local, the repo ships the method, verification stays free forever.
Sources: ADRs.md, THREAT-MODEL.md, CHANGELOG.md.
0.6.0 — on PyPI (trusted publishing), Docker image on GHCR
2026-10-04
0.7.0 → 0.10.0 — the guardrail: tiered scanning with a local LLM judge; detection in French and English
2026-10-10
Randal L. Schwartz publishes his gate-attack catalog; NoireBox replays it as open tests; he names the ordering-vs-authenticity principle "Sam LABBE's Corollary"
2026-10-11
0.11.0 / 0.12.0 — receipts v0.2.x: a verdict cannot be sealed without the specification it was judged against; Schwartz's "Pre-Training Gravity" piece cites NoireBox fifteen times; SCAR-BENCH claims format and an open-weights measurement published
2026-10-13 → 14
0.14.0 → 0.20.0 — the custody ladder: key-holder daemon the agent is not, HSM/PKCS#11 signing, the write-race pin, the custody grade — seven releases in two days
2026-10-15
0.21.0 — the external audit of 0.20.0 answered in public: ten findings, ten answers, none breaking
2026-10-18
0.23.0 — decision + admission receipts: the decision itself becomes a signed event (ADR 026 / ADR 028)
All four lines are already public. Quote freely, attributed as shown.
Prevention varies per stack. Proof is universal.
— Sam Labbé, README
A Makefile DAG proves topological ordering, not evidence authenticity — an agent can never be the notary of its own handwriting.
— Sam Labbé; the line Randal L. Schwartz named "Sam LABBE's Corollary"
NoireBox proves a record was not altered and when it existed. It does not prove the record was true when written. A proof tool, not a talisman.
— Sam Labbé, project positioning
The journal stays local — the repo ships the method. Verification stays free, forever.
— Sam Labbé, project motto
Randal L. Schwartz — "Surviving the 200k-Token Lobotomy" (dev.to, 10 Oct 2026) — the section "The Ordering vs. Authenticity Principle (Sam LABBE's Corollary)".
Randal L. Schwartz, comment on the SCAR replay (10 Oct 2026): "I just read tests/test_scar_replay.py and Issue #53 from top to bottom—this made my whole weekend."
European Commission Futurium — Apply AI Alliance: member introduction post "NoireBox — tamper-evident accountability infrastructure for AI agents" (1 Oct 2026; reading community posts on Futurium requires a free EU Login).
Banner — 1672 × 941. JPG · PNG · WebP — social cards use the JPG.Architecture diagram — 1774 × 887. PNG — for technical pieces.Logo lockup — vector, for dark backgrounds. SVGMark — vector, works on any background. SVG
Usage rules
Name: NoireBox — one word, capital N and B; lowercase noirebox only in code, URLs and package names.
The lockup is drawn for dark backgrounds; on light ones, use the mark on a dark tile rather than recoloring.
Don't restyle the gradient, stretch, tilt or add effects.
Everything on this page is MIT-licensed or original project art — usable in coverage without asking.
