Module attest 

Signed, portable evidence per ticked task.

After a tick commit, the engine writes an in-toto Bundle as the commit’s git note (refs/notes/speccoder): a test-result statement per test phase that ran, one SLSA verification summary and speccoder’s task-verification, each a DSSE envelope signed with the person’s git signing key. accept and skip write a task-verification alone. The model never sees, writes or signs any of it.

Modules

dsse

DSSE envelopes and the in-toto Bundle that holds them.

notes

Attestations as git notes under refs/notes/speccoder: git’s own place for per-commit metadata, outside the commit it describes.

policy

The judge’s configuration as one hash: the policy a VSA names.

sign

Signing statements with the person’s git signing key, as git would: ssh-keygen -Y sign for gpg.format = ssh, gpg --detach-sign for OpenPGP; cosign for opt-in Sigstore. The namespace in-toto keeps a statement signature from ever passing as a commit signature.

statement

in-toto Statements v1 for a ticked task: test-result per test phase, a SLSA verification summary (vsa), and speccoder’s task-verification.

verify

speccoder attest verify: re-checks every task’s attestation against the commit it is about — signatures with the signer’s own tool, against the verifier’s trust, never the project’s.

Structs

Tick

Everything a tick’s statements are made of besides the run report.

Functions

carry

Moves from’s statements to to, the commit that carries the same task’s work onto the feature branch (a parallel lane’s commit, cherry-picked): reissue, then from loses its note.

cites

Whether a task title cites requirement id, as a word of its own.

note_state

What object’s note says, signatures unchecked: signed <kind> <keyid>, unsigned or missing.

now_rfc3339

RFC 3339 UTC, to the second.

outcome

What a tick’s attestation came to, for the run report.

phases

The test phases a run report shows.

record_decision

Records a person’s decision on a task — attested (accept) or skipped (skip) — as one task-verification, no summary: a decision is not a verification.

record_tick

Records a passed tick: test-result per phase, task-verification, then the vsa naming every other line. Never fails the tick.

reissue

Re-issues from’s statements for to, a commit with the same task’s work: the subject, tree and resource move to to, the summary names the new lines, and everything is signed afresh. What the evidence says is unchanged.

sign_all

Signs every envelope that is not signed yet; the first failure’s reason when some stay unsigned.

sign_at

speccoder attest sign: signs the unsigned speccoder statements of the selected task objects with the configured signer, payloads unchanged.