Trust

Approve becomes a signature.

A receipt is a signed statement about one merge: the goal, the head, the evidence, the approver. You can verify it without us.

Anatomy

What a receipt says

Every line on the receipt above is a claim the gate stood behind when it landed the commit. Here is each one, and where it came from.

The goal and the attempt

By number and title. The receipt binds the merge to the intent it answered, so "why did this land" has an answer three years later.

The evidence

Which checks ran and what they said. Sigbound AI's verdict at that exact head, and each done-means line with how it was proven. What the read cost.

The people

Who approved, and when. Who wrote it, and through which harness. An agent that made the attempt cannot appear in the approver line; the gate refuses that before it gets here.

The seal

The commit that landed and the commit main moved from. The signing key's fingerprint, and the ledger sequence, so the chain of receipts is itself checkable.

Verify one

Without us, on any machine

The envelope is DSSE. The page that shows a receipt decodes it; it never verifies. That is on purpose: the check belongs to you.

$ sigbound verify sigbound-landing-62.dsse.json
sigbound-landing-62: signed by SHA256:j86E-8EcfYYa… · commit 53a1332 · verified
The audit log

Every governing act, in plain words

Every act that changes what can sign in, push, decide or land is written to the space's audit log by name. Nothing in it is edited after the fact.

mywifipassword · Settings · Audit log
Sep 8 22:32the gate landed attempt 7.1 on snake-sigbound-2 main · receipt 62
Sep 8 22:31Surya Koritala approved attempt 7.1 · "the Play section now points to Troubleshooting"
Sep 8 22:03the gate refused an approval on attempt 7.1 · change_reviewer_required (the harness that wrote it tried to approve it)
Sep 8 21:40Surya Koritala connected Claude Code to the space · scopes: goals, attempts, evidence
Roadmap

Where we are

The right column is the order we are building in. It will shrink; this page will say so.

You get today
  • ✓Signed receipts, verifiable offline
  • ✓Roles, grants, branch protection, held paths
  • ✓An audit log of every governing act, by name
  • ✓Backups with point-in-time recovery, and a recovery runbook
  • ✓Multi-node, measured, with git in object storage
Not yet, in this order
  1. 1Single sign-on through SAML, and SCIM provisioning
  2. 2A self-host package
  3. 3Bring your own model key for Sigbound AI
  4. 4Data export and account deletion
  5. 5A compliance report