Skip to content
ZicoderaAttesta

Documentation

From install to evidence pack.

A short quickstart, the concepts behind it, and a glossary. Attesta is in private preview, so this documentation is intentionally brief.

Quickstart: Connect, Capture, Prove

  1. 1

    Connect

    Install the read-only git app on one repository. It collects commit and PR metadata, review events, and check results. It does not read source code.

    Learn more
  2. 2

    Capture

    Add the CI attestation step so signed events are recorded as Attested. Ask developers or tools to leave a trailer or label for Declared provenance.

    Learn more
  3. 3

    Prove

    Open the change explorer, review coverage, simulate a policy in warn mode, and export an evidence pack.

    Learn more

Concepts

  • Confidence tiers

    Attested is a signed event from a gateway, agent hook, or CI action. Declared is a git trailer, PR label, or self-declaration. Inferred is a heuristic estimate that is always labelled and never counted as proof.

    Read more
  • The ledger

    An append-only, hash-chained record of provenance events. Each event includes the hash of the previous one, so edits are detectable.

    Read more
  • Policies

    Rules evaluated against recorded events, such as requiring human review for AI-assisted changes on sensitive paths. Run in warn mode first, enforce later.

    Read more

Glossary

TermMeaning
AttestedProvenance backed by a signed event from a gateway, agent hook, or CI action.
DeclaredProvenance stated by a person or tool through a git trailer, PR label, or self-declaration.
InferredA heuristic estimate. Always labelled, never counted as proof.
LedgerThe append-only, hash-chained record of provenance events for a workspace.
CheckpointA periodic signature over the chain head that anchors the ledger at a point in time.
Evidence packA period-scoped export of records, policy results, and verification data.
PolicyA rule evaluated against recorded events, in warn or enforce mode.
Active contributorA contributor with at least one recorded change in the billing period.

Know how your software was made.