Help a maintainer inspect a downloaded agent plugin or release artifact before integrating it. Verify the subject digest and attestation signature, evaluate declared builder and source identities against an explicit policy, and preserve the reason for every rejection. Export a CI gate with authored signed fixtures and a separately verified external-verifier adapter.
Proposed milestones
- Bind artifact bytes to the attestation subject
- Verify signatures against an explicit trust root
- Evaluate builder and source-material policies
- Export a CI gate with reproducible rejection fixtures
This is an upstream project brief; an implementation and completion tests are not supplied.