AIR Blackbox: The Recruiter Who Built a Verifiable Flight Recorder for AI Agents

2026–present · September 21, 2026 · By Yuval Glasman

Solo-built by a tech-recruiting veteran as an EU AI Act flight recorder for AI agents, AIR Blackbox went from first commit to six-failed-Show-HNs to a production compliance stack with externally-anchored, red-teamed evidence.

Sources

Most OSS origin stories start with a company. This one starts with a recruiter. In February 2026, a tech-recruiting veteran with thirteen years at AWS and Meta behind him pushed the first commit of a "black box flight recorder for AI agents" — then watched six Show HNs die on the Hacker News new page while a compliance deadline five months out kept moving under him. Seven months later, AIR Blackbox is a production evidence system with externally-anchored audit chains, a published red-team of its own verifier, and a benchmark file. It is also a project with 23 GitHub stars. Both facts are the story.

The Origin: A Recruiter's Proxy, a 72-Hour Sprint, and a Deadline

February 14, 2026 — first commit under a pseudonymous account

The repository that would become airblackbox/airblackbox was created at 22:19 UTC on February 14, 2026, with the first commit landing the same second: 19d10607 — "Initial commit: AIR Blackbox Gateway v0.1.0" — authored not by Jason Shotwell, but by nostalgicskinco (info@nostalgicskinco.com). The personal account no longer exists (the GitHub user API returns 404), and the project's first Show HNs still point at github.com/nostalgicskinco/air-blackbox-gateway, which now redirects to the org repo. The archaeology says: solo project, personal account, transfer to an organization four days later — the org airblackbox was created on February 18, 2026.

Shotwell's own profile is the unusual part: "Builder of AIR Blackbox — open-source AI governance infrastructure for the EU AI Act. 13+ years in tech recruiting (AWS, Meta)." This is not an ex-Big Tech platform engineer spinning up a side project. It's a domain expert from the demand side of AI hiring — the exact use case (recruitment is Annex III high-risk category #4) his tool polices.

$ gh api "repos/airblackbox/airblackbox/commits?until=2026-02-15T23:59Z&per_page=15"

DATE       SHA       AUTHOR                       MESSAGE
2026-02-14 19d10607  nostalgicskinco             Initial commit: AIR Blackbox Gateway v0.1.0
2026-02-15 ee9229c0  nostalgicskinco             Add golden fixture tests
2026-02-15 c741bef9  nostalgicskinco             Add golden fixture tests, multi-provider detection, fix nested event key bug
2026-02-15 37059935  nostalgicskinco             Fix MinIO startup race: add health check so gateway waits for vault readiness
2026-02-15 28ad57fe  nostalgicskinco             Add interactive test suite demo page
2026-02-15 d926a253  nostalgicskinco             Add custom OTel Collector pipeline with AIR processors
2026-02-15 ae106245  nostalgicskinco             Switch from AGPL-3.0 to Apache-2.0 license
2026-02-15 2ebb98c9  nostalgicskinco             Add architecture diagram and 'Who Is This For?' personas
2026-02-15 b807c30d  nostalgicskinco             Add SECURITY.md, operational guarantees, privacy boundaries, and roadmap

# Day-2 relicensing: AGPL-3.0 → Apache-2.0, before anything had shipped publicly.
# Every early commit's author email domain: nostalgicskinco.com

Two days later the org existed and the satellite repos began: air-platform, python-sdk, agent-policy-engine, agent-episode-store, eval-harness — by February 17, roughly thirty repositories, almost all Python, almost all with 1–2 stars, almost all last touched within days of creation. The HN record shows the same sprint: six "Show HN" submissions between February 17 and March 4 — audit trail, flight recorder, EU AI Act scanner, compliance layer — each gathering 1–3 points and vanishing.

Why it exists at all

The project's reason-to-exist was a date: 2 August 2026, when standalone Annex III high-risk obligations — including recruitment AI — were due to start applying under the EU AI Act. AIR Blackbox's entire pitch was (and is) the flight-recorder move: don't prove your agents are compliant, just make it impossible to lie about what they did. Every LLM call through an OpenAI-compatible proxy generates an HMAC-SHA256-chained .air.json record; evidence exports get countersigned by an RFC 3161 timestamp authority — "a key the operator does not hold". The slogan is honest about its own threat model: "You can still lie. You just can't do it invisibly."

The Timeline: Sprint, Drift, and a Deadline That Moved

2026-02-14 — Repo created and first commit 19d10607 ("Initial commit: AIR Blackbox Gateway v0.1.0") land under the personal nostalgicskinco account. Tag v0.1.0 is published the same day; release notes describe an OpenAI-compatible reverse proxy with MinIO prompt vault, OTel spans, and an 11/11 test suite.
2026-02-15 — AGPL-3.0 → Apache-2.0 relicensing, day 2 (commit ae106245), before any public traction. The project would later state "Apache 2.0, with no relicensing planned."
2026-02-17 → 2026-02-27 — The 72-hour ecosystem sprint: ~30 satellite repos created in the org, from python-sdk and agent-policy-engine to trust layers for CrewAI, LangChain, and later Google ADK and OpenClaw.
2026-02-18 — airblackbox org created; repo transfer follows (first-commits' author remains nostalgicskinco; the account is later deleted). First of six Show HNs — every one dies at 1–3 points.
2026-03-09 → 2026-03-13 — PyPI first publish (0.2.0, March 9); then a version-number firehose: 1.0.0, 1.1.0, 1.2.0–1.2.6, 1.3.0 in five days. A compliance engine with "20+ checks across 6 EU AI Act articles" ships in v1.2.0; AI-BOM (CycloneDX) in v1.3.0.
2026-03-15 — MCP server ships (v1.3.0) for Claude Desktop and Cursor — governance tooling rides the MCP wave within a month of the MCP ecosystem's own breakout.
2026-03-27 → 2026-03-28 — The feature crescendo: prompt-injection detection (20 weighted patterns, 5 categories), GDPR scanner, bias/fairness scanner, ISO 42001 + NIST AI RMF crosswalk, A2A compliance protocol, pre-commit hooks, in v1.6.0/1.6.1.
2026-05-04 → 2026-05-30 — Publication drift. Zero commits to main in May, yet three GitHub releases (v1.8.0, v1.10.0, v1.12.0) were all published May 5 with the same timestamp — a backfill. pip install air-blackbox was getting artifacts from before the security review. v1.14.0 would later admit: "54 commits that were merged but never shipped" and that air-blackbox-comply-strict raised ImportError "on every invocation in all published versions."
2026-06-10 — BENCHMARKS.md published: full recording adds ~3 ms p99 under heavy load, under 0.4% of a typical LLM request, single-node ceiling ~7,200 req/s, zero dropped requests across 15,000+ benchmark requests.
2026-06-11 — v1.13.2, the last "silent-drift" release. From here the pattern changes: security work becomes the product.
2026-07-30 → 2026-08 — The security review lands. Issue #59 tracks adversarial bug-hunt findings; the evidence verifier is red-teamed: 75 attacks, 17 confirmed breaks across 8 root causes, including duplicate ZIP entries smuggling forged members past the signature and a transparency-log receipt checked only against a key it carried itself. All 8 addressed; the unfixed residual (finding 4: no trust root) is published rather than engineered around.
2026-07-24 → 2026-07-27 — The EU moves the deadline. Digital Omnibus on AI (Regulation (EU) 2026/1744) is published in the Official Journal July 24 and enters into force July 27 — five days before the date the project was named after. Annex III high-risk obligations defer from 2 August 2026 to 2 December 2027; Article 50 transparency and AI Office enforcement powers still land on August 2.
2026-08-04 → 2026-08-05 — v1.14.0: the drift reckoning. External RFC 3161 anchoring, Rekor transparency-log anchoring (M2), Evidence Bundle v1, ML-DSA-65 post-quantum receipts, the proof harness, and the confession that the published package had drifted from the repo. Releases are now CI-gated on the built artifact importing and running.
2026-08-29 — v1.15.0: pqcrypto 1.0.0 broke post-quantum signing the day it shipped; the fix supports both API generations. Also: the README's Article 13 overclaim is removed ("No check ever implemented it"), US-law findings are re-labelled out of the EU article namespace, and a build now fails if documented and implemented article sets disagree.
2026-09-08 — Case study published: two weeks of live AI recruiting, 450 consequential decisions recorded, 93 adverse, none without a named human reviewer, verifiable in any browser at airblackbox.ai/verify.
2026-09-19 — Last push as of this writing. README status: "Stable and maintained. Not currently adding features." Roadmap issues closed rather than left to rot; PRs explicitly promised answers.

Architecture: The Evidence Chain That Matters

Strip the marketing and AIR Blackbox is a proxy plus a chain plus two notaries. The design bet is architectural: the operator is the adversary, so the proof must not depend on anything the operator holds.

flowchart LR
    AG["AI agent / LLM app"] --> GW["AIR Gateway
OpenAI-compatible proxy"]
    GW --> CH["HMAC-SHA256 audit chain
.air.json records"]
    GW --> VAULT["MinIO prompt vault
content blobs + SHA-256"]
    CH --> EXPORT["Evidence export"]
    EXPORT --> TSA["RFC 3161 timestamp authority
external countersignature"]
    EXPORT --> REKOR["Rekor public transparency log
optional M2 anchoring"]
    EXPORT --> EV[".air-evidence v1 bundle
signed: Ed25519 / ML-DSA-65"]
    EV --> AUD["Auditor / regulator
air-evidence verify + airblackbox.ai/verify"]

The chain is honest about its own adversary. HMAC-SHA256 linking catches tampering by anyone who lacks the key; the RFC 3161 anchor catches the operator rewriting history and re-signing it, because the timestamp commits to a chain head a key the operator doesn't hold must countersign. ADR 0001 is explicit that the anchor rail exists because the operator is the threat.
The red-team report is the best document in the repo. Finding 6 is the project in miniature: the public transparency-log receipt was checked only against a key it carried itself — "anyone can mint an Ed25519 key" — and the verifier still printed "the entry is permanent" asserting membership it had never checked. The fix is `--rekor-verify`, and without the flag the verifier now says so plainly: "this is self-consistency only."
Post-quantum is a real option, not a badge. ML-DSA-65 (FIPS 204) receipts are opt-in via the `pqc` extra — and v1.15.0's fix shows why the option was dangerous to half-support: `pqcrypto` 1.0.0's `verify()` semantics inverted under `bool()`, so every genuine ML-DSA receipt would have read as tampered. It failed closed, but it was unusable.

Crisis Points: Three Ways a Solo Project Almost Died

1. Six dead Show HNs and the traction it never got

Between February 17 and March 4, 2026, the project submitted six Show HNs — "flight recorder," "audit trail and kill switch," "EU AI Act compliance layer (8/2026 deadline)," "scanner finds 97% of AI agent code non-compliant" — and every one of them died at 1–3 points. For context, the same weeks the "agent security gateway" trend was heating up on HN (AgentPort, Shoofly, Armorer) and those threads drew traffic. The lesson is not that HN is unfair; it's that a compliance tool is an anti-demo: the product is an absence of incidents, and absence does not front-page. AIR Blackbox's eventual audience — auditors, compliance engineers, regulated employers — never was the HN crowd.

2. Publication drift: the release gap that broke every install

May 2026 is the crisis in one line: zero commits to main, three releases published. GitHub releases v1.8.0, v1.10.0, and v1.12.0 all carry the same May 5 publish timestamp — a backfill of tags for work that had landed without release discipline. The PyPI record shows the real damage: 28 versions published between March 9 and June 10, then silence until August. The v1.14.0 release notes are the confession: "a pip install air-blackbox was still getting a build from before the security review, with no anchoring, no evidence verification, and no air-blackbox-mcp / air-evidence commands" — and the strict-mode CLI entry point was broken in every published version. The institutional response is the interesting part: release gating now requires the built artifact to import, resolve every console script, and pass a pqc sign/verify round-trip before publish. A one-person project turned its worst month into a CI covenant.

3. The deadline moved — and the project adapted instead of dying

On July 24, 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) was published in the Official Journal, entering into force July 27 — five days before the compliance date the project was built around. Annex III high-risk obligations — the recruitment-AI category the founder came from — moved to December 2, 2027. A weaker project would have lost its reason to exist. AIR Blackbox's response, visible in the org README badge move from the August 2026 date to "Annex III high-risk Dec 2027", was to reframe: the deadline is now a runway, not a cliff — and Article 50 transparency duties, GPAI penalty regimes, and AI Office enforcement powers still landed August 2, 2026. The tool audits against Articles 9–12 and 14–15 regardless of when conformity assessment begins.

Community Engine: Who Actually Built It

CONTRIBUTIONS  LOGIN             AFFILIATION
178            shotwellj         AIR Blackbox (Jason Shotwell — creator)
 31            jshotwell         AIR Blackbox (same person, second account)
  3            Fancyhe1          community
  3            dependabot[bot]   automation
  2            Sourav1331        community

That's the whole roster: 209 of 217 commits from one human across two accounts, plus three stragglers and a dependency bot. There is no foundation, no working group, no corporate sponsor — just a solo founder, a domain he spent thirteen years inside, and an org of ~30 satellite repositories that are mostly finishing posts on the same sprint. The trust-layer integrations (LangChain, CrewAI, AutoGen, OpenAI Agents SDK, Anthropic, Google ADK, Haystack) are all single-author work; the two outside contributors account for five commits total. Compare Argo CD's 82-maintainer roster: this is the opposite end of the OSS spectrum, and it should be evaluated as such. The bus factor is one, the roadmap is one person's judgment, and the project's own status note — "not currently adding features... an empty backlog means finished, not abandoned" — is a solo maintainer drawing a boundary around scope he can actually maintain.

The corporate-influence story is inverted too. Most platform-OSS tales track a company absorbing a project; this one tracks a founder building a company-shaped org around a personal project, with the founder's recruiting background (AWS, Meta) as both domain expertise and the live production case: the September 2026 case study is a hiring pipeline — 450 decisions, 93 adverse outcomes, every one with a named human reviewer — which is precisely the Annex III employment scenario his tool exists for. The production deployment is, as far as public evidence goes, his own use case.

Current Trajectory: The Verdict

The engineering is better than the traction suggests. Externally-anchored hash chains, a published red-team with unfixed findings left in the open, release gating born from an actual drift incident, post-quantum signatures with both pqcrypto generations supported — this is a more rigorous security posture than several far larger compliance-adjacent projects ship. 23 stars is a marketing number, not an engineering one.
But bus factor is a hard constraint. One contributor, one domain expert, one judge of roadmap. The project says "PRs are welcome and will get an actual answer. Historically some did not, which was a failure of maintenance" — an honest line, and one that reads as an apology for the sprint-era repo sprawl. For regulated employers, the question isn't whether the crypto is sound; it's whether one maintainer answers a security issue in year two.
The scanner is a lead magnet, the chain is the product. The 58-check gap analysis (`air-blackbox comply --scan .`) is the top-of-funnel; the durable value is the evidence chain with RFC 3161 + Rekor anchoring and the browser-verifiable bundle. Auditors don't care how many checks the scanner has; they care that a `VERIFIED` result means something — which is exactly what the red-team report establishes, limits included.
The regulatory window is real, just relocated. The Omnibus moved Annex III to December 2, 2027, but the EU's enforcement machinery (AI Office powers, GPAI penalties) went live August 2, 2026, and Article 50 transparency applies now. The project's US-state-law crosswalk (Colorado SB 26-189, Illinois HB 3773, California FEHA ADS, NYC LL144) is where the near-term demand actually is — those dates did not move.
Watch the verify page, not the README. The strongest claim AIR Blackbox makes is that anyone can verify a bundle in a browser with no upload and no account (airblackbox.ai/verify). If that property survives contact with real auditors, the project has a wedge. If it turns out to be a demo, the whole "verifiable by a third party" pitch collapses into self-signed receipts — the exact failure mode the red-team's finding 4 documents as an honest limit.

Who should skip AIR Blackbox: teams not running LLM agents in a regulated-decision context (the overhead is small but the ceremony is pointless for non-auditable workloads), teams whose compliance obligation is documentation rather than evidence (a policy wiki doesn't need hash-chained receipts), and teams that would not survive a solo-maintainer dependency audit — which, realistically, is most enterprise procurement departments until a second maintainer appears.

Final verdict: AIR Blackbox is the rare compliance tool whose security engineering outclasses its marketing. It was born pseudonymous on Valentine's Day 2026, sprinted thirty repos wide in a weekend, failed six consecutive launches, shipped a broken CLI for months without noticing, got red-teamed into publishing its own vulnerabilities, and watched the EU defer the deadline it was named for — and responded to every one of those events by making the artifact more honest rather than more hyped. The verdict for adopters is conditional: as evidence infrastructure for AI-agent decisions under EU (or US-state) hiring law, the chain design is sound and the red-team report is the kind of primary source a security review can actually trust; as a company bet, it is one recruiter-turned-engineer deep, and you should price that risk accordingly.