Checked by yourself
The party that produced the record also countersigned it. Honest, and free forever, but it's still an account of itself, and the stamp says so.
Action State Countersign
A second signature, from someone who isn't you.
Countersign is a second signature from a party other than you. It accepts your evidence bundle with every payload withheld, recomputes the structural checks its practice statement specifies, signs what it checked and what it found, and keeps its own transparency log. Anyone can already verify your records for free. In SCITT (RFC 9943) terms, Countersign plays the Auditor role.
Operating now, and free while the first businesses come on board; paid terms start after that. Verification stays free and open either way.
What a reader sees
Three states, and the artifact says which one it's in.
A report or bundle carries its own state. The verifier renders the stamp from the countersigner lists the reader chose to trust, so nobody has to take your word, or ours, for which one they're looking at.
Not countersigned
The records are sealed and their checkpoints can be registered with a witness. The stamp is hollow: nobody else has recomputed the checks yet.
Independently checked
A party that isn't you recomputed the checks and signed the result. The stamp names the signer and says what it recomputed.
Remove the Countersign service from your configuration and the next report renders the hollow stamp again. Nothing already checked changes.
Live now
No new integration. The same tool you already seal with.
If you seal records with capsulectl and your checkpoints already go to a witness, a countersignature is one more command at the end of a window. The witness keeps receiving checkpoints exactly as before.
Live at countersign.actionstate.ai.
# at window close: build a bundle with payloads withheld, submit it, attach the entry capsulectl countersign request \ --service https://countersign.actionstate.ai \ --window 2026-10 \ --root <root-capsule-id> --out bundle.json # anyone, later: verify every countersignature on the bundle and resolve its signer capsulectl countersign verify \ --directory https://countersign.actionstate.ai/countersigners.json \ bundle.json
The service sees digests, structure, receipts and report rows. It never sees your payloads: the request refuses any bundle that carries disclosed content.
What it checks
Five checks, and two things it never checks.
In the words of the Countersign practice statement, version 1, a countersignature is “a signature by a party other than the producer over a bundle digest, accompanied by a statement of which claims that party recomputed and with what result.” The service accepts “an Evidence Bundle with every payload withheld (digests only), recomputes a fixed set of structural checks over it,” and signs the bundle digest with the statement of which checks ran and their results. Version 1 runs five checks:
Inclusion against the checkpoint
“The bundle's range proof and per-record inclusion proofs, verified against the bundle's checkpoint.” It reads inconclusive “when the checkpoint carries no independently verifiable signed statement.”
Not checked in version 1
“No profile's own checks are loaded on this instance in version 1,” so it reads not checked whenever the bundle's records declare a kind, and not present when none does.
Reads not present
“The bundle carries one checkpoint, not a history.”
Reads not present
“The bundle declares no window to bound against.”
Reads not present
“Records carry no per-record signer key.”
Each check returns exactly one of five results (established, failed, not present, not checked, inconclusive), and they are “never combined into a score, a grade, or a single pass/fail.”
“Never checked, on any countersignature from this instance: capture coverage (whether everything that happened was recorded) and outcome correctness (whether a judged outcome was right).”
A countersignature over a bundle the operator itself produced “should be read as not independent”; our own sample countersignatures are of that kind. Who may register, key custody, rotation, incidents and wind-down are all in the practice statement.
The countersigner list
Ours is one row. Run your own.
The Countersign engine is open source, in the same codebase as the witness. Anyone can run an instance with their own key and publish their own countersigner list. A verifier renders a stamp only from the lists its reader chose to trust. We aren't special-cased: our stamp renders from our row the same way anyone else's does.
COUNTERSIGNER LIST · ONE ROW
Action State Group · countersign.actionstate.ai/countersigners.json
your row here · your service · your key
What it never says
A countersignature is a recomputation, not an opinion.
- It never rates your agent or gives it a level.
- It never checks capture coverage (whether everything that happened was recorded) or outcome correctness (whether a judged outcome was right).
- It never draws a legal conclusion about your obligations.
- A check by yourself is not independent. When the same party evaluated and checked, the report says independence is not established.
See one
A sample report, and its stamp.
Stand-in. The independently checked sample report is not published yet. Until it is, the sample here is the sealed EU AI Act example, which nobody has countersigned: its stamp reads “Countersigned: none”, the hollow state above.
Open it and find the stamp under “Countersignatures”. The report's last section re-runs ten checks on the sealed records inside the file, in your browser, offline.