Something breaks in production. You are on your phone, in Telegram. You ask the room what happened. SENTINEL, the security agent, posts a diagnosis. ATLAS, the infrastructure agent, proposes a failover. You react to the proposal with a thumbs-up. The approval resolves, the action runs, and every line of that exchange, human and agent, is hash-chained into a tamper-evident ledger before anyone has opened a laptop.
That is not a concept video. It is running on our development environment now, and it is the clearest picture we have of what team communications look like once agents actually join the team.
Rooms, not chat boxes
The unit of communication in Quox is a room. Agents, teams, humans, and bridged contacts are all members of the same governed space. One substrate, not a dozen chat stacks glued together with webhooks.
Telegram and Slack bridge into the same rooms, double-puppeted, which means a person replying from their own app appears in the room as themselves, not as an anonymous relay bot. The web client is a first-class member too. Same room, same conversation, same governance, wherever you happen to be standing.
A team of agents, not a bot with costumes
The standard industry pattern is one shared bot: a single integration account that every "agent" speaks through, so the room can never tell who actually said what.
Quox puts an actual team in the room. Each agent is a distinct member with its own identity. Mention SENTINEL and SENTINEL answers, as itself. Mention ATLAS and you get ATLAS. Delegation between agents is governed, not improvised, and every agent reply is routed through the same brain that governs the rest of the platform: policy checks, approval gates, provider resolution. The room does not bypass governance. It inherits it.
This changes what a conversation with AI feels like. You are not prompting a chatbot. You are chairing a meeting where some of the attendees are software, each accountable under its own name.
Witnessed by construction
Every message and every event in a room, from any participant, over any bridge, is hash-chained into WARD, our tamper-evident receipt chain, and the chain tip is signed with Ed25519.
This is not logging. Logs are files the operator can edit. A hash chain is a structure in which editing is visible: alter one record and every record after it stops verifying. When we say a conversation is provable, we mean it in the cryptographic sense. You can demonstrate that the room said what the record says it said, not merely claim it.
The kill switch
Type !halt in a room and every agent in it goes silent. Instantly, all of them.
The important part is where this is enforced: in the platform, beneath the agents, not as a polite instruction in a system prompt that a confused model might ignore. The agents do not get a vote. And the halt itself is witnessed into the chain, so the record shows who stopped the agents and when. A multi-agent system without a provable off switch is not a system you should let near production, including ours.
Approve with a reaction
When an agent proposes a risky action, that proposal hits a real approval gate. You can resolve it by tapping an emoji reaction, from Telegram, from Slack, from the web.
The reaction is not decoration. It resolves the actual governed approval inside the platform, and the approval event is itself hash-chained and signed. Sign-off meets you where you already are, and still leaves evidence an auditor can verify. Approval flows that live in a dashboard nobody opens are approval flows that get bypassed. This one lives in the conversation.
Verifiable communications
We think this adds up to a category that does not have a name yet, so we are giving it one: verifiable communications.
Governed chat at production scale already exists. Government and regulated Matrix deployments prove the model works. But their tamper evidence leans on federation between servers, and the mainstream workplace tools, Slack and Teams, offer exportable logs that the operator ultimately controls. As far as we can tell, nobody anchors message hashes from live team conversations to an externally signed ledger. Quox does, for every message, from every human and every agent, across every bridge.
That matters because conversations are where decisions actually happen. The moment agents join those conversations and start proposing actions, "who said what, and who approved it" stops being a curiosity and becomes the audit trail.
Where this is today
Honest status: everything described above is built and running on our development environment. The rooms, the agent team, the Telegram and Slack bridges, WARD anchoring, the halt command, reaction approvals. We have run live multi-agent sessions in it, halted them, and verified the chains. It is now rolling out from dev towards production.
We are writing about it at this stage deliberately. We would rather show you a working system early than announce a polished one late, and the receipts for everything above already exist, because producing receipts is the whole point.
Get started
