Platform
Sources in. Ledger. Policy. Evidence out.
A small number of moving parts, each doing one thing, with certainty labelled at every step.
Confidence tiers
How each claim is known is part of the record.
| Tier | Source | Examples | Counted as proof? |
|---|---|---|---|
| Attested | Signed events from a gateway, agent hook, or CI action | CI attestation step; agent session hook | Yes, subject to the signing source |
| Declared | Statements by people or tools in a readable form | Commit trailer; PR label; self-declaration | Evidence of what was declared |
| Inferred | Heuristic estimates | Change-shape analysis; missing declaration | Never counted as proof |
Ledger verification, explained
Each event stores the hash of the previous one: hash(n) = SHA-256(hash(n-1) + canonicalJSON(payload(n))). The first event links to 64 zeros. Change any payload and every hash after it stops matching, so verification points to the first event that broke. Try it below.
What Attesta is designed to collect, and not collect
| Area | Designed to collect | Designed not to collect |
|---|---|---|
| Code | Repository and file paths, commit identifiers, change size | Source code, diffs, and file contents |
| Changes | PR identifiers and titles, branch names, labels, trailers, author handles | Code review comment text is not needed by the core ledger |
| Review | Reviewer, decision, and timestamp | Private messages |
| CI | Check names, status, and timestamps | Build logs and artifacts |
| AI tools | Tool and model names, session identifiers, timestamps | Prompts and model outputs, unless you opt in to a documented capability |
| Secrets | Nothing | Credentials, tokens, and keys. Gateway will redact configured patterns. |
| Integrity | SHA-256 hashes linking each event to the previous one | Nothing further |
This is design intent for a product in private preview. Behaviour may change before general availability, and any future capability that needs more access will be opt-in and documented.
Multi-tenant and isolation principles
One ledger per workspace
Each tenant has its own hash chain. Events from different tenants never share a chain.
Scoped access
API keys and roles are limited to a workspace and to specific actions.
No cross-tenant reads
Queries are scoped by tenant at the data layer, not only in the interface.
Per-tenant keys
In designCheckpoint signing keys are per tenant. Signed checkpoints are on the roadmap.