SPIF packages a prompt, model metadata, tool calls, retries, and agent handoffs into one signed .spif artifact you verify offline, no network trust service needed. CBOR-chunked binary, Ed25519 sign/multi-sign, checksum tamper detection. Benchmarked against real provenance systems: vs in-toto, roughly tied on verify, 8% smaller payload. Vs Sigstore keyless, ~417x faster verify (no network/transparency-log round trip). Open source, Apache-2.0.
