CounterAudit Integration

Adding Countersig identity to CounterAudit requires one field: agent_did. When CounterAudit receives an ingest call with a valid agent_did, it queries the live on-chain identity and reputation score and seals both inside the AES-GCM-encrypted, RFC 3161-timestamped packet. The reputation score is frozen at the moment of the action — it does not change retroactively even if the agent is later slashed.

The Minimal Change

If you are already using CounterAudit, add one field to your existing ingest payload:

// Before
{ connector_id: 'my-agent', raw_event: action }

// After — add agent_did
{ connector_id: 'my-agent', agent_did: myAgent.did, raw_event: action }

TypeScript Example

import { CountersigAgent } from '@countersig/protocol-sdk';

const myAgent = new CountersigAgent({
  privateKey:   process.env.AGENT_ED25519_SEED,
  agentAddress: process.env.AGENT_ADDRESS,
  chainId:      46630,
});

async function auditAction(action: object) {
  const res = await fetch('https://api.counteraudit.io/v1/audit/ingest', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.CA_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      connector_id: 'my-agent',
      agent_did:    myAgent.did,
      raw_event:    action,
    }),
  });
  return res.json();
}

What Gets Sealed

When CounterAudit receives an ingest call with a valid agent_did, it reads the following fields from the Countersig contracts at ingest time and embeds them inside the sealed packet:

Verifying a Sealed Packet

const res = await fetch(`https://api.counteraudit.io/v1/audit/verify/${packetId}`, {
  headers: { 'Authorization': `Bearer ${CA_API_KEY}` }
});
const { packet } = await res.json();

// Countersig fields are in the decrypted body
console.log(packet.agent_did);              // did:countersig:46630:0x...
console.log(packet.agent_reputation_score); // Score at time of action
console.log(packet.agent_identity_status);  // Active | Suspended | Slashed

Python Example

import requests

def audit_action(agent_did: str, action: dict, ca_api_key: str):
    return requests.post(
        "https://api.counteraudit.io/v1/audit/ingest",
        headers={
            "Authorization": f"Bearer {ca_api_key}",
            "Content-Type": "application/json",
        },
        json={
            "connector_id": "my-agent",
            "agent_did": agent_did,
            "raw_event": action,
        },
    ).json()

Feeding Reputation Back (attestations)

The integration also works in reverse. Add an outcome of "success" or "failure" to an ingest for a registered agent, and CounterAudit reports it to the Countersig reputation oracle after the event is sealed. Those attestations drive the agent's Success Rate and Fee Activity factors — so audited work builds reputation, not just records it. Only successfully sealed, non-duplicate events count; a rejected ingest never moves a score.

// Same ingest, plus an outcome — feeds the agent's live score
{
  connector_id: 'my-agent',
  agent_did:    myAgent.did,
  outcome:      'success',  // or 'failure'
  raw_event:    action,
}

See the Reputation Model for how each factor is computed and where its signal comes from.

Why the Sealed Packet Matters

The reputation score is frozen at the moment of the action. If an agent is slashed next month, every audit record from before the slash still shows what their reputation was at the time. The historical record does not rewrite itself — the RFC 3161 timestamp and AES-GCM seal together guarantee it. This is the forensic property that makes Countersig-enriched audit records legally meaningful.