CycloneDX 1.6 SBOM construction, SLSA provenance, NTIA validation and Sigstore signing as typed services.

MDA v1.0 source-mode loader: frontmatter extraction, integrity, Sigstore signature verification, requires.network enforcement.

The Agent Protocol — the accountable agent runtime. SOP compiler, MCP allowlist + circuit breaker, PII-redaction interceptor, a signed action ledger + forensic scan (on @kashscript/attest), exception classification, AIUC-1 work certificates, DID registry,

Deterministic versioning capability — intent files in, signed release out. A seam over semver: own the flow, delegate the arithmetic.

AINumbers Helm — local-first control plane for verifiable connected workflows (installs the native helmd binary for your platform).

code-signing for npm packages

Verifiable-credential supply chain compliance for npm. Sign attestations, verify dependencies, revoke compromised packages.

Sigstore signing library

Policy enforcement, kill switch, and telemetry for AI agent API calls. Intercepts fetch(), evaluates against a signed policy in a WASM sandbox, and emits signed telemetry.

Offline verification CLI for Evidary evidence bundles.

Sigstore CLI

Sigstore CLI

Verify a Queldrex Trust Receipt, decision ruling, Proof-of-Detection, evidence bundle, or transparency-log inclusion/consistency proof offline, without trusting queldrex.com. Zero dependencies. Includes a CLI.

Open schema and verifier for the Agent Witness Protocol (AWP) — tamper-evident, customer-keyed, offline-verifiable witness records. Verify a receipt without trusting, or asking, the producer.

Oreoasis SDK — sign an AI agent's action locally and get a signed, publicly-verifiable receipt.