WorkAttest

Evidence can be difficult to connect to a decision.

AI-assisted work can involve requests, authorisations, work evidence and later checks. WorkAttest is intended to make that chain easier to inspect without presenting the receipt as a replacement for human judgement.

Signed, offline-verifiable receipts

• Links request, authorisation, evidence and validation records.
• Uses Ed25519 signed receipts that can be verified offline.
• Keeps the workflow local-first rather than sending work data to a hosted service.

Original project by Miguel Santos. Its public repository is the source of truth for the current implementation, documentation and limitations.

Evidence is not a production security guarantee.

WorkAttest is presented here as an MVP, source-only project. It does not claim that code is correct, that a model is reliable, or that an approval is competent.

• Its development key storage is not a production security control; private signing keys need suitable custody, such as an approved KMS, HSM or equivalent process, before production use.
• Verification commands are defined by a trusted operator. WorkAttest records their result, but does not establish that an arbitrary command or configuration is safe.
• Receipts bind the documented process and artefacts; they do not replace a security audit, human judgement or regulatory review.