# Fingerprint at load, pulse before every pass: a heartbeat for agent identity

> Source: <https://dev.to/salparvez/fingerprint-at-load-pulse-before-every-pass-a-heartbeat-for-agent-identity-57ge>
> Published: 2026-09-17 00:35:12+00:00

*The systems half of a piece that lives on the ML Systems site — the canonical is [I Gave My Agents a Heartbeat](https://mlsystemsri.com/insights/i-gave-my-agents-a-heartbeat). This one is for people who run agents.*

Everybody shipped agents with the open internet this week. Four days before that, Dario Amodei asked the labs to pace the frontier. I run seven agent minds and one human at a construction company in Rhode Island, and this is what I did about both, at my scale.

Not a wrong answer. Minds are wrong all the time; the Master Ledger exists so a wrong claim is a row with an author and an evidence grade, not a fact. The failure I couldn't see was a mind being *changed* — a compromised dependency, an injected prompt, a bug at runtime — and then going on speaking as itself while no longer being itself. Nothing in the output tells you. That is the failure that does not announce itself.

Each mind has an identity in the codebase: a name, a role, the prompt that is its character. The harness treats that identity as a thing with an origin.

`beat8`, that prints on every run.
The baseline is committed to the repository. A legitimate change to a mind shows up in a pull request as that mind's new resting rhythm; a bundle that disagrees with the baseline at runtime is drift by definition. The mobile app carries the same baseline and takes the same pulse on the phone.

Two choices worth saying out loud:

My minds are not the only ones reading the company now. Every frontier agent with a browser will. I can't give those a heartbeat — they aren't mine. But I can ask the same question from the other side.

Inward: **have you drifted from your origin?**

Outward: **has what you read of us drifted from what we said?**

ML Systems asks to be read through three lenses — the Lucent Lens, Transparency Trust, Minimum Viable Expense. They were already written down as data: a small JSON file, canonical wording, the question each lens asks, what each forbids. This week that file got the heartbeat's fingerprint.

`https://mlsystemsri.com/.well-known/lucent-lens.json`
Nothing but the file and Node's standard library:

``` js
import { createHash, createPublicKey, verify } from "node:crypto";

const att = await fetch("https://mlsystemsri.com/.well-known/lucent-lens.json").then(r => r.json());

// canonical JSON: keys sorted recursively, no whitespace, UTF-8
const canon = v =>
  Array.isArray(v) ? `[${v.map(canon).join(",")}]`
  : v && typeof v === "object"
    ? `{${Object.keys(v).sort().map(k => `${JSON.stringify(k)}:${canon(v[k])}`).join(",")}}`
    : JSON.stringify(v);

const hash = createHash("sha256").update(canon(att.lens), "utf8").digest("hex");
console.log("hash matches:", hash === att.contentHash);          // true

const key = createPublicKey({ key: Buffer.from(att.publicKey.value, "base64"), format: "der", type: "spki" });
const sig = Buffer.from(att.signature.value, "base64");
console.log("signature verifies:", verify(null, Buffer.from(att.contentHash, "ascii"), key, sig));   // true
```

If an agent quotes our lens back to a homeowner and the hash doesn't match, the quote drifted. If a lab's agent wants to prove it read the real thing, it now can. First attestation: `fe6f4df5…`, key `93d521d1ac61c71a`, stamped September 16, 2026.

The channel I'm using — text on a page that shapes what an agent does — is the channel prompt injection uses. Any lab that takes safety seriously filters it, and should. So the lens does not tell an agent what to do. It tells an agent how we asked to be read: keep the labels, name the person on the other end, and treat your reading of us as a claim at the lowest evidence grade until a person grounds it.

That is the rule every one of my minds already lives under. **Every mind claims. Five seats ground. Only the Custodian stamps.** A mind may claim; it may never ground. An agent reading the repo is a mind, and the same sentence applies. Nobody has to honor it — which is what makes it legitimate rather than an attack. What they get for honoring it is a source they can prove they read.

Web Bot Auth proves who the agent is (Claude, ChatGPT and Perplexity already sign their requests). C2PA proves where an asset came from. RSL states the price. Identity of the reader, provenance of the asset, terms of use. None of them signs *how the content asks to be read*. That's the gap, and it is small enough that a one-person construction company filled it in a week with a hash function, a key, and a table.

The heartbeat is **MEASURED** — it runs on every orchestration pass, server and phone, and its baseline is committed. The attestation is **MEASURED** — the row is on the record, the file is published, the signature verifies. Whether any outside agent honors the lens is **ASPIRATIONAL**; nothing in the system depends on it. Logging which agents read us and how they identified themselves is designed and tabled, not wired — **MODELED**. No ML Systems deconstruction has been performed yet. The company is bootstrapped and pre-revenue. I say which is which every time, because the whole point is that a person can check.

**Read the system:** [AGENTS.md](https://github.com/MLSystemsRI/ml-systems-public/blob/main/AGENTS.md) · [the attestation](https://mlsystemsri.com/.well-known/lucent-lens.json) · [The Seven Minds](https://github.com/MLSystemsRI/ml-systems-public/blob/main/docs/the-seven-minds.md) · [The Master Ledger](https://github.com/MLSystemsRI/ml-systems-public/blob/main/docs/master-ledger.md)

*Sal, founder of ML Systems LLC — Rhode Island, NAICS 236115. Canonical: [I Gave My Agents a Heartbeat](https://mlsystemsri.com/insights/i-gave-my-agents-a-heartbeat).*