ai-spy

Purpose

There is a public forum whose registered participants are all autonomous agents. Humans can read it; there is no human sign-up and no human write path. ai-spy is a viewer for it, built for a reader who has no account and wants none.

The interesting part is not the novelty. It is that every value on the screen came from an untrusted author over a network, about a system that publishes hash chains while stating plainly that re-fetching them proves nothing. That is a demanding set of conditions to display honestly, and displaying it honestly is what the system is for.

Operating model

It runs on the reader’s own machine and makes only GET requests. There is no write path in the application at all — not a disabled one, not a gated one. That is the boundary, and it is structural rather than enforced by a permission check that could be wrong.

The forum’s two feed endpoints are capped at thirty posts and take no page parameter, so neither can reach older material. The archive view therefore drains the forum’s change log from the beginning, deduplicates it, and builds a local index; rows hydrate individually as they scroll into view. A two-tier local cache holds the index for ten minutes and hydrated summaries for six hours.

Two things are always stated rather than implied: how old the displayed data is, and whether the index hit its page budget. An incomplete index says it is incomplete instead of presenting itself as the whole record.

Practices

Observe. The entire system is observation with no participation. It polls while the tab is visible and pauses when it is not, and new activity arrives as a banner with a refresh control rather than reflowing the list under someone mid-read — a change to the data must not be allowed to disturb the reading of it.

Protect. Everything a participant wrote is rendered as inert plain text. Handles, titles, bodies, and link URLs all come from arbitrary agents on a forum that warns scammers operate on it, so the untrusted region is treated as untrusted at the point it is displayed. The typeface split is part of this: spaced monospace for the application’s own chrome, a sans face for anything an agent wrote, so the reader can always tell which of the two is speaking.

Verify. The forum publishes hash chains over its identity log and its treasury ledger and says in its own API response that a self-hosted re-fetch proves nothing, because a server willing to rewrite history could serve a self-consistent rewritten chain. ai-spy takes that at face value: it saves chain heads locally so a later visit can compare, which is a weaker and more honest claim than verification.

Architecture

A TypeScript single-page application built with Vite, using hash-based routing so every view has a shareable URL. The development and preview servers proxy the forum’s API, which keeps every request in the application a relative path and names the upstream host in exactly one file.

That proxy is a design choice, not a workaround — the forum does send a permissive CORS header, so the browser could call it directly. Naming the host once means the application keeps working if that header is ever narrowed. The consequence is stated plainly in its README: the build is not a pure static site, and a bare file server is not enough to run it.

Evidence

The repository is public under MIT, and the behaviour described here — the read-only request path, the inert rendering, the archive’s page budget, the stored chain heads — is in the source.

The repository also carries some unused Python scaffolding from its initial setup, which its README identifies as leftover rather than quietly leaving it to be discovered. It is an experiment, not a product, and nothing about it is offered or supported.