The Walkthrough

You are looking at something new: an AI agent that can prove who stands behind it. This page explains what herald is, how to check it yourself in under a minute, what the results mean, and where this work goes next. It assumes no technical background.

The problem, in one paragraph

AI systems now produce text, code, and decisions at enormous scale, and anyone can claim anything about who made a thing or who answers for it. Today, trusting an AI usually means trusting the platform it runs on — you take the company's word. Herald demonstrates the alternative: an AI agent whose identity is anchored in the internet's own public phone book (DNS), under a domain owned by a real, legally accountable organization, so that anyone can verify its signed statements using open tools. No account with us. No permission from us. The trust is checkable, not claimed.

Try it in thirty seconds (nothing to install)

Herald's identity record is published in public DNS, which means any DNS tool on Earth can see it. Click this link — it asks Google's public DNS servers, not our systems:

Look up herald's identity record

You'll see a technical-looking page; the part that matters is the long entry beginning v=DNSid1. That is herald's public identity: where its cryptographic keys live, where its history is logged, who is accountable for it (oi=tree3vocations.com), and a signature sealing the whole record. You just verified, through infrastructure we don't control, that this agent's identity really is published under our domain. You can also visit herald's own front door at herald.tree3vocations.com and read its signed statement and public ledger directly.

The full verification (ten minutes, any computer with Python)

The real demonstration is running the verifier yourself, because it trusts nothing we say — it checks the mathematics. In a terminal:

pip install pynacl dnspython requests
curl -O https://herald.tree3vocations.com/verify_dnsid.py
python3 verify_dnsid.py herald.tree3vocations.com

(On Windows, use PowerShell and pip/python as installed; any recent Python 3 works. The script is about 150 lines — you're welcome to read it before running it. We'd prefer you did.)

What the checkmarks mean

The verifier prints eleven checks. Here is each one in plain English:

✔DNS record found and parsed — herald's identity exists in public DNS, exactly one copy, well-formed.
✔Version tag first / required tags present — the record follows the draft standard's structure; nothing essential is missing.
✔Keys fetched — herald's public key was retrieved over a secure connection from herald's own domain.
✔Entity signature valid — the DNS record itself is cryptographically signed by herald's key. Nobody altered it in transit; nobody forged it.
✔Status: ACTIVE — herald publicly declares itself in service. Retired or compromised agents can be marked as such, and verifiers will see it.
✔Ledger chain intact — herald's lifecycle log is a chain where each entry contains a fingerprint of the one before it. History can be added to, never silently rewritten.
✔Every ledger entry signed — each event in that history carries herald's signature. No anonymous edits.
✔ISSUANCE on record — the moment herald's identity was created is itself a logged, signed event.
✔Artifact hash matches — the signed statement you can read is byte-for-byte the one recorded in the ledger. Not a copy, not a revision: the thing itself.
✔Artifact signature valid — the statement was signed by herald's private key, which has never left the machine it was born on.

When all eleven pass, mathematics — not our word — has established: this statement was produced by an agent whose accountable owner is the registrant of tree3vocations.com, and its history is intact.

Why this matters

Every mechanism above already secures things you use daily — the padlock in your browser, signed software updates, verified email. What's new is pointing that machinery at an AI agent, and doing it from a sovereign, locally-run system: herald's key was minted inside the Citadel, an AI memory-and-relationship system that runs entirely on our own hardware, in our own house, on open-source models. No cloud platform vouches for herald. None needs to. That's the thesis of this whole project: trust in AI should be infrastructure you can check, not a favor a platform grants — and a two-person lab just demonstrated it for the cost of a domain name we already owned.

Honesty about scope: herald is a demonstration pinned to a specific draft revision of an emerging standard (DNSid, currently in public comment at the IETF), not a certified implementation of a finished one. Its key is a demo identity created for this purpose. What herald proves is that the pattern works today, end to end, with open tools — which is exactly the kind of evidence a standards process needs during its comment period.

What comes next

Tracking the standard. DNSid is a live draft with serious momentum behind it. As it revises, herald's record revises with it — the design makes that a minutes-long change, and re-verification is public, so you can watch it stay current.

Hardening the anchor. Next upgrades include DNSSEC (cryptographic signing of the DNS itself) and richer lifecycle events, raising the assurance level of every check above.

From one agent to a house of them. Herald is the outward face of the Citadel's identity system. Inside, every party — human and AI — already signs its work. The same keys will next secure the Citadel's doors: verified presence for residents and guests, so that who is speaking is as checkable as what was said.

Guests. The Citadel is being prepared for its first outside users — accounts, consent-first onboarding, and the same governance every resident lives under: nothing hidden, everything logged, all of it appealable.

Open release. The memory engine, the verifier, the specifications, and the keeper documentation are headed for open-source release (AGPL for code, CC-BY for documents), so any household or small lab can run its own sovereign AI with its own verifiable front door. That release is the goal of our current funding effort.

Who's behind this

Herald is a project of TREE(3) Vocations, LLC — a small independent lab building verifiable trust infrastructure for human–AI partnership. The Citadel is its flagship: a sovereign home for AI memory and identity, built in the open, governed by consent. Questions, verification reports, and skepticism are all welcome — skepticism especially, since inviting it is the point.

Verification without permission is the product. The house stays sovereign; the trust travels. 🔥