# Chirindo by Headless Oracle > Evidence for AI agents. Chirindo signs each agent action into a hash-chained log. Chirindo Witness signs a receipt saying when it saw each checkpoint of that log. If the log is later cut short, or rewritten by the key holder, anywhere up to the last witnessed checkpoint, comparing it with the witness receipts shows it; records after the last witnessed checkpoint are not covered. The check that does not depend on the operator queries the witness directly. What a witness receipt is and is not, in the spec's words: An operator sends signed chain checkpoints to the witness, which records each one and signs a receipt saying when it saw it. The witness attests only "at time T, I received this checkpoint, validly signed by the key with this thumbprint". It does not attest who owns the key, nor that the records are true. Verifying against a sidecar file trusts the operator who supplied it. Only querying the witness is independent of the operator. Every limit: https://api.headlessoracle.com/v1/witness/spec (honest_limits). ## Chirindo Witness - [Witness spec (machine-readable)](https://api.headlessoracle.com/v1/witness/spec): wire contract, the checks in order, error codes, and honest limits. - [Submit a checkpoint (POST only)](https://api.headlessoracle.com/v1/witness/checkpoints): body {"checkpoint":{"v","type","session_id","count","last_entry_hash","ts","kid","sig"},"public_key_jwk":{...}}, an Ed25519-signed checkpoint with its public key as a JWK; exact rules in the spec. No account is needed for the free pool. - Query the receipts, no setup: GET https://api.headlessoracle.com/v1/witness/checkpoints?kid=&session_id=. This is the check that does not depend on the operator. - Host: https://api.headlessoracle.com and https://headlessoracle.com serve the same /v1/witness/* paths. ## Pricing - Free: anonymous checkpoints from a shared pool of 2,000 new checkpoints per UTC day, shared by every anonymous caller. Once it is used up, a new anonymous checkpoint gets 503 witness_unavailable until the next UTC day. - Evidence Starter: $49/month, your own Witness key, up to 1,000 new checkpoints per UTC day. Plan id custody_90d. Introductory until 31 December 2026. - Evidence: $199/month, your own Witness key, up to 3,000 new checkpoints per UTC day. Plan id custody_1y. Introductory until 31 December 2026. - Evidence pilot for a team in its audit window: $4,900 fixed, scope agreed by conversation. Write to mike@headlessoracle.com. - Buy: POST https://headlessoracle.com/v5/checkout with {"plan":"custody_90d"} or {"plan":"custody_1y"}. The response carries a hosted payment url (a person pays by card) and a claim_token. After payment, POST https://headlessoracle.com/v5/claim with {"claim_token":""} returns the key, for 24 hours. If no key appears, write to mike@headlessoracle.com with the transaction ID from your Paddle receipt. Send the key as Authorization: Bearer on POST https://api.headlessoracle.com/v1/witness/checkpoints. - Machine-readable prices: https://headlessoracle.com/v5/pricing ## Tools - [Chirindo gate (npm @headlessoracle/chirindo)](https://www.npmjs.com/package/@headlessoracle/chirindo): a fail-closed cryptographic gate at the MCP tool-call boundary that signs a receipt for each decision. Source: https://github.com/LembaGang/chirindo (Apache-2.0). Witness support (chirindo checkpoint, --witness) is on GitHub main and not yet in the npm release (0.4.0). - [receipt-verify (npm @headlessoracle/receipt-verify)](https://www.npmjs.com/package/@headlessoracle/receipt-verify): a cross-format agent-receipt verifier. Source: https://github.com/LembaGang/receipt-verify (Apache-2.0). - [Test kit](https://github.com/LembaGang/chirindo/tree/main/examples/e015-4-kit): five tampering cases and an untouched control, run against a local stub witness, not Headless Oracle's. ## Contact mike@headlessoracle.com ## Market-state attestations (also available) Headless Oracle also returns Ed25519-signed receipts saying whether an exchange is OPEN, CLOSED, HALTED, or UNKNOWN, for 28 global exchanges, with a 60-second TTL. UNKNOWN must be treated as CLOSED (fail-closed). Used as a pre-trade gate by autonomous trading agents. Agents can pay per call with x402 (USDC on Base mainnet) with no API key. - [Full Documentation](https://headlessoracle.com/llms-full.txt): Complete API reference, schemas, and integration guides in one file. - [MCP endpoint](https://headlessoracle.com/mcp): tools get_market_status, get_market_schedule, list_exchanges, get_payment_options - [GET /v5/demo](https://headlessoracle.com/docs): Free signed demo receipt (no auth) - [GET /v5/status](https://headlessoracle.com/docs): Signed market-state receipt (key, free trial, or x402) - [GET /v5/batch](https://headlessoracle.com/docs): Multi-exchange batch check - [GET /v5/schedule](https://headlessoracle.com/docs): Next open/close times with lunch breaks - [GET /v5/exchanges](https://headlessoracle.com/docs): All 28 supported exchanges - [MCP Setup](https://headlessoracle.com/docs/quickstart): npx headless-oracle-mcp for Claude Desktop, Cursor, Windsurf - [JavaScript SDK](https://www.npmjs.com/package/@headlessoracle/verify): npm install @headlessoracle/verify - [Python SDK](https://pypi.org/project/headless-oracle/): pip install headless-oracle - [x402 Payment](https://headlessoracle.com/docs/x402-payments): Pay-per-call $0.001 USDC on Base - [Pre-Trade Verification Pattern](https://headlessoracle.com/docs/specifications/pre-trade-stack): composable deployment pattern for autonomous trading agents - [Multi-Oracle Consensus Protocol v1.0.1](https://headlessoracle.com/docs/specifications/multi-oracle-consensus-v1): consensus across independent market-state feeds - [Daily Digest](https://headlessoracle.com/v5/audit/digest): Merkle root of all daily attestations - [Receipt Schema](https://headlessoracle.com/v5/keys): Full canonical payload specification - [Conformance Vectors](https://headlessoracle.com/v5/conformance-vectors): live-signed test vectors for SDK authors ## HO's own daily record - [Daily record](https://headlessoracle.com/record) ([Markdown](https://headlessoracle.com/record.md)): once a UTC day, a signed, hash-chained record of Headless Oracle's own previous day (the halt digest it served, the receipt-verify registry index, witness, MCP and x402 counts), witnessed by Chirindo Witness, which is HO itself, and timestamped with OpenTimestamps; a timestamp becomes a Bitcoin attestation once the calendars confirm it. /record.md says how to check it without us. ## Standards - Headless Oracle co-authors the IETF draft family defining environmental constraints for Verifiable Intent. [IETF draft](https://datatracker.ietf.org/doc/draft-borthwick-msebenzi-environment-state/) **Earlier working-spec names (retired):** SMA, MPAS, and APTS were earlier internal working-spec names for concepts now consolidated into the environment.* family. The canonical specification is the IETF draft family above. ## Optional - [OpenAPI Spec](https://headlessoracle.com/openapi.json): Machine-readable API definition (Witness operations are served from https://api.headlessoracle.com) - [Agent metadata (JSON)](https://headlessoracle.com/.well-known/agent.json)