Launching today

SPIF

Launching today

Signed, tamper-evident provenance for AI outputs

1 follower

Signed, tamper-evident provenance for AI outputs

1 follower

Visit website

SPIF packages a prompt, model metadata, tool calls, retries, and agent handoffs into one signedspif artifact you verify offline, no network trust service needed. CBOR-chunked binary, Ed25519 sign/multi-sign, checksum tamper detection. Benchmarked against real provenance systems: vs in-toto, roughly tied on verify, 8% smaller payload. Vs Sigstore keyless, ~417x faster verify (no network/transparency-log round trip). Open source, Apache-2.0.

Free

Launch tags:Developer Tools•Artificial Intelligence•GitHub

Launch Team

Viktor.comAn AI coworker that actually does the work

Promoted

Maker

📌

Hey PH! Multi-step AI pipelines (model, tool call, retry, agent handoff) lose the trail once you flatten everything down to text or JSON logs. After the fact you can't answer "what produced this, was it changed, can I prove it." SPIF packages that whole trail into one signed, offline-verifiable artifact. I benchmarked it against real provenance systems, not just plain JSON. Against in-toto's signed DSSE envelope, it's roughly tied on verify speed with an 8% smaller payload. Against Sigstore's keyless signing, it's about 417x faster on verify since it skips the network and transparency-log round trip by design. I tried to be upfront about the gaps too. No public transparency log like Sigstore/Rekor, no policy language like in-toto.

Report

18h ago