Signing outside the agent.

Wake has to keep a record no agent can rewrite. Two of its rules pull against each other there: events should be signed where they’re captured, and agents should never hold the keys to their own record. Wake’s SDK and its memory adapter run inside the agent’s own process, so they can’t do both.

The decision

On October 26, 2026, we settled it: every event is signed at the first hop outside the agent’s process. The SDK and the memory adapter send their events unsigned, over TLS, to the collector, which runs out of band and signs each one as it arrives, with an Ed25519 key. The proxy that carries agents’ MCP and A2A calls runs as a process of its own, with its own short-lived identity, and signs what it sees itself, with ECDSA P-256. The collector checks those signatures, then appends every event to the log. Nothing that runs inside an agent holds a signing key.

Why

A key inside the agent’s process is one a compromised agent can use. For as long as that key lives, the agent could sign whatever it liked, and the record would vouch for it. Signing at the first hop the agent can’t reach keeps the guarantee that matters: once an event leaves the agent, nobody can change it without breaking its signature.

What it costs

An event from the SDK is only as honest as the agent process that sent it. That’s true of anything captured inside an agent, signed or not. So the proxy’s own signed record of the same MCP and A2A calls is the independent check: a call the proxy saw that the SDK didn’t report, or reported differently, is a signal worth raising.

Before anything is signed

The log keeps every payload for good, so a credential an agent put in a message or a tool call would stay readable there. Before signing, the signer replaces each credential it recognizes with a placeholder that names its kind and the start of its hash, so two mentions of one credential can still be matched. The signature then covers the payload as it’s kept, through its SHA-256 digest.

Checking it without us

Anyone can check the log without trusting Wake, or whoever stores it. The open source wake-log verify checks the log’s signed checkpoint, that every entry is in the signed tree, and every event’s signature and payload. All of it is in the recorder’s code, which anyone can read.