The foundation · agent-work · fleet-attestation

One record shape.
One way of
signing it.

Four tools that each invented their own file format would not be a stack — they would be four products you have to buy together. Everything here writes one open record shape and signs it one way, which is why the artifacts compose, and why nothing above is locked to us.

agent-work owns record@0 and is its normative reference and validator. fleet-attestation is the signing atom, extracted after a dozen repos independently rebuilt the same thing: canonical JSON, domain-tagged Ed25519, hash chains, offline public-key verification. Zero runtime dependencies — node:crypto only.

A machined hardened-steel punch die standing upright, its engraved face catching the light.

In detail

How it
works.

Canonical formRFC 8785 (JCS) — keys sorted, compact, undefined omitted, non-finite numbers rejected
Domain separationA required domain string is mixed into the signed bytes, so one product’s signature can never verify as another’s. That is deliberate, not an oversight
ClocksTimestamps are passed in, never read. The library never touches the system clock — same inputs, same bytes, same signature, forever. The test suite greps the source to enforce it
Verify pathZero runtime dependencies, no network, no floats. Parse before crypto; fail closed everywhere
Not a shared runtimeConsumers pin a tag and vendor that exact version. There is no floating “latest”, and drift between consumers is expected
Adopt the rails; do not found a standard.

A sealed record can be expressed as an in-toto attestation predicate in a DSSE envelope, so it rides supply-chain tooling auditors already encounter — in-toto and SLSA verifiers, transparency logs, policy engines — rather than asking anyone to adopt a private format. The record inside is unchanged; the envelope is produced alongside, never instead. The value sits in capture quality and the honesty discipline, not in owning a file extension.

Straight answers

What this
does not prove.

Stated here, at full size, rather than in a footnote. Every tool in the stack carries its own ceiling, and they are not the same ceiling.

An open format not yet an interoperable one

Expressing records as an in-toto predicate is provisional and the interoperability question is still open. We do not claim a record verifies today under someone else’s toolchain.

Deterministic bytes not a trusted clock

Because timestamps are injected, a record’s times are exactly as honest as whatever supplied them. Trusted time is an added countersignature, not something the core can assert.

Run it

Free,
and local.

emit signed intact and tampered examplesnode cli.mjs demo examples
✓ INTACT (6 steps, signature: valid)node cli.mjs verify examples/session.intact.json
✗ TAMPERED — first altered step: #3node cli.mjs verify examples/session.tampered.json

Everything above runs on your machine with no account and no network call. Checking an artifact is free permanently — see what we actually charge for.

Previous in the stackWill an auditor accept it?

The agent will act either way.

The only question is whether anything survives it that a stranger can check.

Check a record See all four