Latest release

Continuum Attest 0.2.0 — Paper Moon

Transfer keys and revocations in a signed bundle. Require the checks you need and read a verdict that states what was verified.

CLI 0.2.0 · Linux and macOS · Apache-2.0

View Paper Moon on GitHub

New in 0.2.0

Paper Moon

Trust you can share and a verdict that states its checks.

Signed trust bundles: keys, dated revocations, validity windows, updates and rollback rejection.
Explicit requirements with --require: a skipped check never satisfies a requirement. JSON verdicts add policy, execution and trust_material.
Per-control isolation reports, protected declared inputs and signing in a separate process with attest sign.
Evidence size limits before parsing, rejection of ineffective options and verification of 0.1 receipts, including signatures.

View Paper Moon on GitHub

Previous release · 0.1.0

Amber Drift

Run a build, sign its receipt, and transfer verifiable evidence with the result.

View Amber Drift on GitHub

Release scope

The standalone CLI remains Apache-2.0 on Linux and macOS (x86-64 and arm64). The receipt schema remains version 3; 0.1 receipts remain verifiable. Plugins and transparency-log publication remain future work.

Public specifications

Read the contract behind the receipt

The formats are publicly documented so recipients can inspect the evidence and implement their own verifier.

Receipt format

Receipt schema, canonical file hashing, signing bytes and trust-store rules used by the current release.

Plugin protocol

Draft specification for future extensions. Version 0.2.0 does not run plugins; receipt verification works without them.

A valid receipt is evidence of signed claims and matching hashes. It does not certify software quality or compliance. Bundles carry revocations known at their last update; they cannot reveal later revocations. Causal roots are not published to a transparency log, and a signing key does not establish a legal identity.