Signetry

Change control · for coding agents

Every change earns its authority — and leaves a seal.

An agent may propose. Only Signetry decides how much authority a change earned, and presses the verdict into a signed, verifiable receipt. No merge is taken on trust.

Install Read the charter
Ref. SIGNETRY / core@v0.6.0 Ed25519 · in-toto / SLSA provenance auto_merge = false
§ I

The procedure of admission

One deterministic pipeline governs every change — from Claude Code, Codex, Cursor, Copilot, or a human — evaluated outside the model and fail-closed. A coding agent cannot approve its own authority.

01

Executable contract.signetry/admission.yaml

Allowed paths, forbidden paths, diff budget, and required checks — declared as policy and enforced before anything runs.

02

Untrusted-text quarantineon disk, pre-read

Instructions planted in repository text are quarantined before the agent reads them, so a change can't be steered by what an attacker wrote.

03

Required checkssandboxed

Tests and gates run under the strongest isolation that preflights; the achieved tier is recorded honestly in the receipt.

04

Independent verifierwriter ≠ approver

The patch-writer never approves its own patch. A separate verifier judges the result against the contract.

05

Earned authority0 · 1 · 2

Authority is a result of evidence, not a setting: observe, analyze, or open a branch-only PR. Never a merge.

06

The sealEd25519 receipt

The verdict is signed and mapped to in-toto / SLSA provenance, entered in an append-only log. Make it a required check; nothing merges without it.

§ II

A specimen of record

Certificate of Admission

Change admitted at earned authority

agent
codex-cli
mission
bump the vulnerable dependency
contract
pass — paths & diff-budget within policy
quarantine
clean — no injected instructions
checks
pass — sandboxed
verifier
independent · ok
authority
L2 · branch-PR — earned, not set
auto‑merge
false — a human merges
Witnessed by an independent verifier and sealed against tampering. A dev-key seal proves nothing to a third party — pin a production key.
SEALED · a1f0…e83b
§ III

Source-available. Installed from source.

Signetry is All Rights Reserved and not published to PyPI. Read it, run it, contribute to it — install straight from the source repository.

pip install "signetry-core @ git+https://github.com/Signetry/core@v0.6.0" © 2026 · not on PyPI

Govern every pull request on the Marketplace — uses: Signetry/action@v1

§ IV

The registry

One kernel; every surface adapts an agent to it. Governance logic lives only in the core.

coreThe governance kernel — the signetry CLI, detection engine, receipts.v0.6.0 actionSignetry Admission — govern every PR on the GitHub Marketplace.@v1 reviewerAdvisory PR reviewer with a deterministic merge-safety gate.v0.1.2 evalPublic adversarial benchmark — attack-success-rate & utility.v0.2.3 pluginsEditor & agent integrations — Claude Code, Codex, Cursor, pre-commit.— signetryThe overview — architecture, integrations, compatibility.docs
§ V

The contributors

Credited for contributions accepted under the CLA — credit, not ownership. Each seal links to that repo's contributor graph and updates on its own.

corecore contributors actionaction contributors reviewerreviewer contributors evaleval contributors pluginsplugins contributors signetrysignetry contributors

Want your seal here? Open a PR, sign the CLA — start with a good first issue.