v0.1.2

Obsign is an enforceable audit log of agent actions: a gateway that speaks MCP
between an agent and its tool servers, arbitrates every act against a signed
Cedar policy, and writes a hash chain an auditor can verify offline, months
later, with access to neither your infrastructure nor ours.

This is the version the repository opens on. The critical path runs end to
end: an agent speaks MCP to the gateway, the policy decides, the log is
sealed, and the auditor verifies offline.

Verify it without trusting us

cargo run -p obsign-audit-core --example gen_sample -- /tmp/sample
cargo run -p obsign -- verify /tmp/sample/evidence.json \
    --trusted-keys /tmp/sample/trusted-keys.json      # exit 0

sed -i '' 's/"outcome": "deny"/"outcome": "allow"/' /tmp/sample/evidence.json
cargo run -p obsign -- verify /tmp/sample/evidence.json \
    --trusted-keys /tmp/sample/trusted-keys.json      # exit 1

The second run reports three failures at once: the hash chain breaks, the
gateway's signature over that record stops verifying, and the sealed Merkle
root no longer matches what the records recompute. Editing one field of a
sealed log means forging three independent things held by three different
keys.

The first run ends on a warning, identity_not_attested, and that is the
product working: the sample enrols no TPM, so nothing proves which software
ran under the gateway key, and the verifier says so rather than staying quiet.

Images

Four distroless single-binary images, multi-arch, cosign-signed:

docker pull ghcr.io/obsign/obsign-proxy:0.1.2     # the gateway
docker pull ghcr.io/obsign/obsign-ledger:0.1.2    # sealing, away from the gateway
docker pull ghcr.io/obsign/obsign-control:0.1.2   # policies from git, signed releases
docker pull ghcr.io/obsign/obsign:0.1.2           # the offline verifier

Air-gapped delivery works from docker save tarballs, so the registry is a
convenience and never a dependency.

Since v0.1.1

SECURITY.md, which says where to send a break and, as importantly, what is
already known and therefore not one. A ci workflow running the two commands
CONTRIBUTING.md asks a contributor to run, plus a check that every commit in
a pull request is signed off. And a version tag that agrees with the version
its binaries report, which v0.1.1 did not.

No change to any crate, to the record format, or to anything signed.

What this version does not claim

obsign verify without --trusted-keys exits 3, not 0: a pack that vouches
for itself proves nothing, and key anchoring has to come from another channel.
The Known debt section of the README lists what is exempt from
arbitration and why. SECURITY.md states what is in scope for a vulnerability
report.

Apache-2.0. Contributions under the DCO, sign-off required.