Verifiable trust levels for software releases in the age of AI-authored code.
When agents write a growing share of software, a version number's implicit claim — safe drop-in replacement — needs evidence behind it. SemVer-Trust encodes cryptographically verifiable trust levels (T0–T3, counting the independent accountable humans behind a release) in standard SemVer pre-release identifiers, so under-evidenced releases are opt-in by construction:
v1.4.0-t1.1 < v1.4.0 ← low-trust releases sort below the clean
version; default resolvers skip them
Signed attestations carry the full provenance evidence — who authored, who reviewed, what was proven. SemVer-Trust completes a stack: SLSA answers how was this built, sigstore answers who signed this, and SemVer-Trust answers what human evidence stands behind this release's claims.
| Repository | Contents |
|---|---|
| spec | Normative specification (draft v0.2), design record, decision log (ADRs), schemas, conformance vectors |
| semver-trust-go | Official Go reference implementation (pre-implementation) |
Early and deliberately open: the specification is a working draft, the
conformance suite and reference implementation are in progress, and design
discussion happens in spec issues.
Start with the specification and the design
record in spec/docs/ — the project keeps its full reasoning on the record.
Specification text is CC BY 4.0; schemas, conformance vectors, and code are Apache 2.0. Use of the SemVer-Trust name and conformance claims is governed by the trademark policy.