AL / 01

Attest Lens

LOCAL EVIDENCE MICROSCOPE

One pinned P-256 key · one bounded fixture · no network

Artifact promotion / fail closed

Trace trust until it breaks.

Cryptographic integrity is not policy acceptance. Inspect each independent gate before this build crosses the release line.

Selected gate receipt

No receipt issued

UNREADRun verification to issue a gate-by-gate receipt.

Canonical signed payloadnot read

{"_type":"https://in-toto.io/Statement/v1","predicateType":"https://slsa.dev/provenance/v1","subject":[{"name":"attest-lens-1.0.0.tgz","digest":{"sha256":"5d189ad1c2f53da457f3ec0ad474759aad231622604f0f1452cd3941a140bb70"}}],"predicate":{"builder":{"id":"https://github.com/bradleybeatz1313/attest-lens/actions/workflows/release.yml"},"buildType":"https://slsa.dev/provenance/v1","source":{"repository":"https://github.com/bradleybeatz1313/attest-lens","revision":"a17e57f"}},"signer":{"identity":"release@attest-lens.example","issuer":"https://token.actions.githubusercontent.com"}}

Declared subject5d189ad1c2f53da457f3…

Artifact sampleattest-lens release artifact