witness v0.3.0: faster journal, oracles, fleet mode, exec recording

Four features, built in parallel and merged the same session.

Journal group commit (#9). Appends now flow through a single writer thread that fuses concurrent submissions into one write and one flush per batch (up to 256 records). Measured on the same machine as the README numbers: recording ceiling up from ~37k to ~53k calls/sec, p99 at c=20 down from 1.4 ms to 0.58 ms, added p50 about 0.22 ms. The writer also re-syncs the chain tip per batch, closing a stale-tip hazard when a second process (witness attest, witness mcp) appends to a journal a proxy is serving from.

Verifier oracles (#3). witness attest --seq N --oracle '<shell command>' runs any command as a judge over a recorded response (body on stdin, exit 0 = verified). A verified response becomes unconditionally cacheable regardless of sampling parameters, and the attestation itself is journaled with the exact command, so an auditor sees who vouched for what. witness attested lists them.

Fleet mode v1 (part of #1). witness serve --peer <url> --peer-token <secret>: on a local cache miss for a reusable request, siblings are asked before the upstream, with a 300 ms budget per peer. Peer bodies are verified against their advertised content hash, so a peer can serve you bytes but cannot poison you. Peer hits journal locally as cache="peer" and show up in metrics. Scope is honest: no consistent hashing, journals stay per-instance, attestations do not travel.

Exec recording (Layer 3). witness run -- <command> fingerprints the working directory before and after, tees output live, and journals the diff (added, modified, deleted, with hashes) plus stdout, stderr and exit code. witness diff --seq N pretty-prints it, and witness audit now follows exec records into their recorded output. Optional --docker <image> runs the command in a container.

88 tests. Binaries for Linux (x86_64, arm64) and macOS (arm64, x86_64) attached.

witness v0.2.1: anchoring works against the real Rekor

Fixes anchoring against the production Sigstore Rekor service. The v0.2.0 entry construction used a pure Ed25519 signature with a SHA-256 digest, which the live log rejects for this key type. Entries now carry the SHA-512 of the commitment and an Ed25519ph signature over the same prehash, which is what Rekor's verifier requires.

Proven against production: the first publicly anchored witness commitment is entry 108e9186e8c5677a272ab6a6f598f63b7dfc6be258ddcea859531f7bbff78cbfc0d36b45de6da347 (logIndex 2791554212), anchored with witness anchor and independently re-verified with witness anchor-verify.

If you downloaded v0.2.0 and plan to use witness anchor, upgrade. Everything else in v0.2.0 is unchanged.

witness v0.2.0: anchor, standard export, observability, MCP recording

Four features, built in parallel and merged the same session.

Rekor anchoring (#2). witness anchor --key <keyfile> signs the latest Merkle commitment and publishes it to Sigstore Rekor, so a third party can check your record against a log you do not control. witness anchor-verify re-fetches and compares. --dry-run prints the exact entry without posting; --rekor-url targets private logs.

Standard export. witness export-record emits the journal as a dossier following IETF draft-maintainer-1f916-agent-record-01: RFC 6962 tree hashing, JCS canonicalization, RFC 7638 thumbprints, signed checkpoints, offline verify-record with the draft's four-valued verdict. Conformance is documented honestly in the README, including what draft -01 leaves undefined.

Observability (#8). GET /witness/metrics in Prometheus text format, and --otlp-endpoint projects each recorded call onto an OTel GenAI span. Zero new dependencies, fire-and-forget off the hot path.

MCP recording (Layer 2). witness mcp -- <server command> wraps any stdio MCP server and records every tools/call into the same hash-chained journal as model calls. Zero record-format changes; a golden-record test pins byte-level compatibility with existing journals. witness audit now covers tool activity too.

Overhead is unchanged: about 0.25 ms added p50 per recorded call, roughly 33k recorded calls/sec (bench/bench.sh). 58 tests.

Binaries for Linux (x86_64, arm64) and macOS (arm64, x86_64) attached.

witness v0.1.2 — concurrency fix + measured overhead

Fixes a concurrency bug present in v0.1.0 and v0.1.1. The content-addressed store used one shared temp path per object, so concurrent writers of identical content raced: one rename won and the others failed. Under load about 2% of requests returned 500 (verified 22/1000 at c=20; now 3000/3000 at c=50). Cache index writes are now atomic and write-once as well. Upgrade if you are running an earlier build.

Measured overhead (new bench/bench.sh, and now in the README):

scenario	p50	p99	req/s
direct (baseline)	0.29 ms	0.48 ms	63k
record	0.54 ms	1.2 ms	34k
record+sign	0.56 ms	1.2 ms	33k
cache hit	0.44 ms	1.4 ms	43k

Recording adds ~0.25 ms at the median; Ed25519 identity verification adds ~20 µs. Throughput plateaus near 37k recorded calls/sec — see #9 for the journal group-commit work that would raise it.

Also new: witness sign emits Pact headers for curl and load generators; regression tests for concurrent CAS puts and concurrent proxied calls (17 tests total).

Binaries for Linux (x86_64, arm64) and macOS (arm64, x86_64) attached.

witness v0.1.1

Launch release: recording proxy, Pact identity + delegation enforcement, hash-chained journal, cache/replay, Merkle commitments + inclusion proofs, audit.

Binaries for Linux (x86_64, arm64) and macOS (arm64, x86_64) attached. Or build from source: cargo build --release.

Since v0.1.0: demo GIF + regenerable recording setup, one-line integration examples (Anthropic SDK py/ts, LangGraph, signed shell flow), comparison table, four-platform release automation.

witness v0.1.0

First release: recording proxy, Pact identity + delegation enforcement, hash-chained journal, cache/replay, Merkle commitments + inclusion proofs, audit. macOS arm64 binary attached; build from source for other platforms (cargo build --release).