Module attest 

Signed, portable evidence per ticked task.

After a tick commit, the engine writes an in-toto Bundle as the commit’s git note (refs/notes/speccoder): a test-result statement per test phase that ran, one SLSA verification summary and speccoder’s task-verification, each a DSSE envelope signed with the person’s git signing key. accept and skip write a task-verification alone. The model never sees, writes or signs any of it.

Modules

branch

speccoder attest verify --branch (and attest badge): every ticked task of the units a branch touches, mapped to the commit that carries its evidence and checked with attest verify’s own rules (super::verify::object), plus what only a branch can show: a tick with no evidence at all, a task line edited after its tick, a cited requirement changed since, a commit a squash merge lost.

check

The speccoder / evidence check run, rendered from a branch report: the verdict bar and the trust it used (summary), the requirement trace, every tick and its tour (text), and one annotation per tick that is not plainly verified, on the line it is about. The same, as workflow commands and a step summary, where the check cannot be published.

dsse

DSSE envelopes and the in-toto Bundle that holds them.

notes

Attestations as git notes under refs/notes/speccoder: git’s own place for per-commit metadata, outside the commit it describes.

policy

The judge’s configuration as one hash: the policy a VSA names.

sign

Signing statements with the person’s git signing key, as git would: ssh-keygen -Y sign for gpg.format = ssh, gpg --detach-sign for OpenPGP; cosign for opt-in Sigstore. The namespace in-toto keeps a statement signature from ever passing as a commit signature.

statement

in-toto Statements v1 for a ticked task: test-result per test phase, a SLSA verification summary (vsa), and speccoder’s task-verification.

verify

speccoder attest verify: re-checks every task’s attestation against the commit it is about — signatures with the signer’s own tool, against the verifier’s trust, never the project’s.

Structs

Tick

Everything a tick’s statements are made of besides the run report.

Functions

carry

Moves from’s statements to to, the commit that carries the same task’s work onto the feature branch (a parallel lane’s commit, cherry-picked): reissue, then from loses its note.

cites

Whether a task title cites requirement id, as a word of its own.

note_state

What object’s note says, signatures unchecked: signed <kind> <keyid>, unsigned or missing.

now_rfc3339

RFC 3339 UTC, to the second.

outcome

What a tick’s attestation came to, for the run report.

phases

The test phases a run report shows.

record_decision

Records a person’s decision on a task — attested (accept) or skipped (skip) — as one task-verification, no summary: a decision is not a verification.

record_tick

Records a passed tick: test-result per phase, task-verification, then the vsa naming every other line. Never fails the tick.

red_of

The last at most predicate::RED_EXCERPT_MAX bytes of output (on a character boundary), with its digests; withheld when not clean (a local path, a credential): only clean text is signed. None for a class that is not red.

reissue

Re-issues from’s statements for to, a commit with the same task’s work: the subject, tree and resource move to to, the summary names the new lines, and everything is signed afresh. What the evidence says is unchanged.

sign_all

Signs every envelope that is not signed yet; the first failure’s reason when some stay unsigned.

sign_at

speccoder attest sign: signs the unsigned speccoder statements of the selected task objects with the configured signer, payloads unchanged.