A witness is whatever supplies the state a condition reads. It is named in the onus before funds lock, agreed by both sides, and after that it is the only thing that can move the money. onus itself is not a witness and cannot become one.
| witness | supplies | for conditions | trust assumption |
|---|---|---|---|
| attester (EAS) | a signed attestation on Arc against a schema | C1 delivery, C4 dispute | the attester is honest; identity is on-chain |
| price / data feed | a value at a time | C2 oracle | the feed you both named; onus recommends a second feed as bound |
| checker contract | true/false on (spec, result) | C3 result | the checker's code, which is public |
| the clock | block timestamps | C4 time, all lapses | Arc's validators |
| resolver | a decision on a dispute | C4 disputes | whoever you named; can be a checker, a multisig, a person |
Witnesses register on Arc with a name, a kind, a schema or interface, and a record: onuses served, releases, lapses, disputes. Anyone can list; nobody is endorsed by onus. When you write an onus you pick from the registry or paste an address; the cheque shows the witness's record before you sign.
A carrier that attests reliably accumulates a record and gets named in more onuses. A checker that is wrong gets disputed and its record shows it. Reputation is the registry's byproduct, not its purpose.
There is no admin key on the onus contract. There is no pause. There is no function that releases funds without a witness signature or a lapse timestamp. We cannot help a payee who was cheated by a bad witness, and we cannot help a payer who named a witness carelessly.
This is the price of a settlement layer that cannot be pressured. We would rather you name your witnesses carefully than trust us to fix it later.