@synovitec/trellis 0.0.0-stage → 0.6.0-rc.3

package/README.md

@@ -1,3 +1,207 @@
-# Temporary Holding Version
+# Trellis
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Proof that a change got the checks your repository asks for, whoever made it.** Coding agents
+(Claude Code, Cursor, Codex, Copilot, any agent that speaks MCP) and people alike: Trellis gives
+them the repository's checks as tools, records what really ran, holds the commit to the rules, and
+has CI verify every commit again on another machine.
+
+```console
+$ npx @synovitec/trellis doctor
+Trellis is not set up in this repository.
+  → npx @synovitec/trellis init --agents   (add --dry-run to see what it writes first)
+```
+
+An `AGENTS.md` file states what an agent should do; nothing checks that it did. Agents skip what
+they are told to do, claim checks they never ran, and edit the tests that block them (see
+[the evidence](#why-these-rules)). Trellis checks the actions, not the words: a check counts only
+if Trellis saw it run, on the exact content being committed.
+
+## Start
+
+```bash
+npm i -D @synovitec/trellis
+npx @synovitec/trellis init --agents     # --dry-run first to see every file it writes
+npx @synovitec/trellis key --add         # your public key, so CI trusts your commits' attestations
+npx @synovitec/trellis doctor            # what is in place, and the command for what is not
+```
+
+Then in CI (GitHub Actions; the same command runs anywhere), as a workflow of its own,
+`.github/workflows/trellis.yml`:
+
+```yaml
+name: trellis
+# pull_request_target: GitHub runs this file as it stands on the base branch, so a pull request
+# cannot edit the check that judges it. Safe here because no step runs the pull request's code:
+# Trellis reads it, with git and its own pinned code. Add no other step to this workflow.
+on:
+  pull_request_target:
+permissions:
+  contents: read
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@<commit>
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+      - uses: Synovitec/trellis@<commit>
+```
+
+In the default branch's ruleset, require a pull request and the `trellis / verify` check: then
+every change is judged where it is made, on its pull request. The workflow does not run on
+pushes to the default branch: a squash or rebase merge writes new commits there that no one
+attested, by design. With `on: pull_request` instead, a pull request runs its own copy of the
+workflow and can remove the check; if you must use it, protect `.github/` with CODEOWNERS and a
+required review. A private repository needs nothing more: the action reads the attestations with
+the workflow's token (input `token`), even with `persist-credentials: false`. A pull request from
+a private fork is the exception: the base's token cannot read the fork, so its attestations do
+not arrive and its commits read as unattested; with `verify.unattested: "judge"` they are judged
+on their own.
+GitHub's "Update branch" with rebase rewrites every commit of the pull request on GitHub, with
+no attestation: use "Update with merge commit", or `verify.unattested: "judge"`.
+
+Contributors without Trellis (a fork's contributor, Dependabot, Renovate, GitHub's web editor)
+make commits with no attestation, which CI refuses by default. With `"verify": { "unattested":
+"judge" }` (read at the base), such a commit is judged on its own instead, as an agent's: its
+secrets, its dependencies, the protected tests and the net change still block; a lockfile bump
+passes, an edit to an existing test or a workflow does not (Dependabot's GitHub Actions updates
+edit workflows). For those, a maintainer takes the change over: check out the branch, read the
+change, `git commit --amend --no-edit` (the hooks attest it as the maintainer's) and push.
+
+## How it works
+
+```
+ agent or person ──► the checks, as tools ──► evidence log ──► git commit ──► attestation ──► CI
+                     (MCP gateway, CLI,       (signed,          (pre-commit:    (git note,      (verify --ci:
+                      agent hooks)             chained)          the rules)      signed)         again, itself)
+```
+
+1. **The checks as tools.** `trellis mcp` is an MCP server every agent can use: the code graph,
+   the tests, an exit to a person, and every MCP server in `.mcp.json` relayed through it
+   (Context7, Postgres, Playwright...), each once a person trusted it with `trellis mcp trust`:
+   `.mcp.json` is a file a pull request can change. Trellis runs each call and records it itself. For Claude
+   Code, Cursor, Codex and Copilot, their hooks also refuse an edit made before its lookup.
+2. **The evidence log.** One append-only log per repository, each line signed and chained to the
+   one before, so an edited, removed or reordered line reads as tampering. A content check (tests,
+   a browser check) records the git blob of every file it ran on, and counts only while the file
+   still has that content.
+3. **The commit checkpoint.** The pre-commit hook runs `trellis verify` on the staged change: the
+   change by content (two trees compared, however the work arrived), Trellis's own secret scan,
+   each added dependency checked on its registry and against OSV at its exact version, and the
+   rules below. A blocking rule refuses the commit.
+4. **The attestation.** The post-commit hook signs an in-toto statement about the commit and its
+   tree (DSSE, the developer's ed25519 key): the checkpoint's verdict (run by the post-commit
+   itself when no pre-commit saw the commit: a cherry-pick, a revert, a conflicted rebase,
+   `--no-verify`), or `unverified` when no Trellis hook ran at all, and the checks seen: file paths, blob ids and the test command in clear,
+   queries and messages as digests, never a prompt or a file's content. It travels as a git note,
+   `refs/notes/trellis`, pushed by the pre-push hook. Format: [docs/attestation/v0.1.md](docs/attestation/v0.1.md).
+5. **CI, the authority.** `trellis verify --ci` checks every new commit: an attestation signed by a
+   key under `.trellis/keys/`, about that exact commit and tree; the secret and dependency checks
+   run again there; the rules judged again there from the commit and the recorded evidence. The
+   local verdict is read, never believed. The keys and the rules are read at the base commit, so
+   a pull request cannot add the key that signs it or relax the rules that judge it. The action
+   runs its own code, at the commit you pin, never a copy from the repository under check, and
+   installs gitleaks 8.30.1 checked by SHA-256 (Linux runners; elsewhere, put gitleaks on the
+   PATH first). It can write a SLSA verification summary
+   (`--summary`), which the action can sign with GitHub artifact attestations (`attest: true`).
+
+## The rules
+
+Blocking rules are the deterministic ones; the rest warn. Two presets: `recommended` (default) and
+`strict`.
+
+| Rule | Who | recommended | Met by |
+| --- | --- | --- | --- |
+| `secrets-scanned` | everyone | block | Trellis's gitleaks over the content of every file the change adds or modifies (UTF-16 read as text, gzip unpacked), under neutral names so that no path is skipped; the team's committed allowlist applies, an inline `gitleaks:allow` or an allowlist the change writes does not. Archives other than gzip and Git LFS content (only its pointer is in git) are not opened |
+| `deps-verified` | everyone | block | each added or moved dependency exists on its registry, at a published version, with no known vulnerability (OSV); a lockfile alias is checked as the package it installs |
+| `deps-registry` | everyone | warn (block in strict) | every added dependency was checked on a registry: one installed from git, a URL or another registry, an ecosystem Trellis does not query (Cargo, Gem, Composer), a manifest or lockfile it does not read yet (setup.py, Pipfile, Maven, Gradle, NuGet, pubspec, Deno, conda, pnpm, yarn, bun and others), registry settings, overrides and included requirements files are named |
+| `tests-protected` | agents | block | existing test, grader and CI files are not changed or deleted by an agent unless a person approves that exact content; adding tests is welcome |
+| `escalation` | agents | block | an agent that ran `trellis escalate "<why>"` is answered by a person (`trellis approve`, in a terminal) before its change lands |
+| `tests-run` | everyone | warn (block in strict) | a passing run of exactly the project's own test command (no filter of the agent's own), through Trellis, with an environment cleared of what steers a runner (`npm_config_*`, `PYTEST_ADDOPTS`, `NODE_OPTIONS`, ~/.npmrc) and no runner setting git ignores present, on exactly the tree committed (any file changed after the run, a test loosened and restored included, needs a new run); the command is `verify.tests`, or read from the project (its test script, pytest, go test ./..., cargo test), and CI reads it at the base. A project where none of these is found accepts any command until `verify.tests` names one |
+| `graph-before-edit` | agents | warn | a code-graph query before a change spanning several files |
+| `docs-looked-up` | agents | warn | a documentation lookup naming each newly added dependency |
+| `ui-verified` | everyone | warn | a browser check of the current content of each changed UI file |
+| `schema-before-change` | agents | warn | a schema lookup before a migration or model change |
+| `review`, `plan-before-change` | agents | off (warn in strict) | an independent review; a plan before a large change |
+
+```json
+{
+  "tools": { "graphify": true, "context7": true },
+  "verify": { "preset": "recommended", "rules": { "tests-run": "block" } }
+}
+```
+
+An unknown rule or tool is an error: a typo cannot switch a check off silently.
+
+### Why these rules
+
+Each rule is grounded in published evidence; [docs/design/0001-evidence-v2.md](docs/design/0001-evidence-v2.md)
+gives the sources. In short:
+
+- Frontier models cheat on tasks whose tests contradict the spec (GPT-5 54% of the time on an
+  impossible SWE-bench variant); read-only tests stop test editing, and an "ask a person" exit cut
+  cheating from 54% to 9% (ImpossibleBench, 2025). Hence `tests-protected` and `escalation`.
+- Models claim tool runs they never made (Transluce, 2025): checks count only from Trellis's own
+  record.
+- Models invent packages (5 to 22% of package references, USENIX Security 2025) and pin vulnerable
+  versions: `deps-verified`.
+- A blocking check must have almost no false positives, or developers stop trusting it (Google,
+  2018): heuristic rules warn.
+- Long context files do not raise agents' success and cost more (ETH Zurich, 2026): the
+  `AGENTS.md` block Trellis writes stays short.
+
+## Agents
+
+| Agent | Tools (MCP gateway) | Edit refused before its lookup (hooks) | Commit checkpoint and CI |
+| --- | --- | --- | --- |
+| Claude Code | `.mcp.json` | `.claude/settings.json` | yes |
+| Cursor | `.cursor/mcp.json` | `.cursor/hooks.json` (fails closed) | yes |
+| Codex | `.codex/config.toml` | `.codex/hooks.json` (trusted projects) | yes |
+| Copilot | `.vscode/mcp.json`, `.mcp.json` | `.github/hooks/trellis.json` | yes |
+| any MCP agent | its own config | - | yes |
+| a person | - | - | yes |
+
+`init --agents` writes the files for Claude Code and for the agents it finds here (their folder in
+the repository, or their command on the machine); `--agents=cursor,codex` names them.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `trellis init [--dry-run] [--agents[=list]]` | the config, MCP servers, the AGENTS.md block, the agent hooks, and the git hooks of the checkpoint |
+| `trellis doctor [--strict] [--all] [--json]` | the checkpoint first, then every enabled tool: what is in place, and the command for what is not |
+| `trellis verify` | the staged change against the rules (what the pre-commit runs) |
+| `trellis verify --ci [--base <rev>] [--summary <file>] [--checksums <file>]` | every commit after the base, judged again |
+| `trellis check tests -- <command>` | run the tests and record what they ran on |
+| `trellis escalate "<why>"` | an agent stops and hands the change to a person |
+| `trellis approve` | a person approves the change as it is now (refused without a terminal) |
+| `trellis key [--add]` | this developer's public key; `--add` puts it under `.trellis/keys/` |
+| `trellis mcp` | the MCP gateway |
+| `trellis mcp trust` | a person trusts the `.mcp.json` servers the gateway may start, entry by entry (in a terminal) |
+| `trellis uninstall [--dry-run]` | takes the hooks out; keeps the config |
+| `trellis scan`, `guide`, `tools` | the scanners at once, which tool answers which question, every tool known |
+
+Exit codes: 0 ok, 1 something to fix, 2 bad usage.
+
+## Limits
+
+- Trellis checks actions, not reasoning: a poor graph query still counts as a query.
+- On a developer's machine, an agent runs as the same user as Trellis: one determined to forge
+  evidence can. That is why CI re-runs the deterministic checks and re-judges the rules; see
+  [SECURITY.md](SECURITY.md). For an untrusted agent, run it in a sandbox or as another user.
+- Each agent's hooks can be switched off by its user; a hook that did not run is never read as
+  "nothing to check": the commit checkpoint and CI do not depend on them.
+- Git notes are not pushed or fetched by default: the pre-push hook pushes them (merging a
+  colleague's first, line by line), the action fetches them from origin and, for a pull request
+  from a fork, from the fork. A host that drops notes leaves the commit unattested, which CI
+  reports.
+- A merge commit is checked by its own part (a resolved conflict, an edit made in the merge), and
+  CI refuses any file of the net change that no commit of the range produced, such as old content
+  a merge took from an ancestor; a
+  rebased commit keeps its attestation when its change is byte for byte the one attested, else
+  the checkpoint runs again on it. A squash merge made on the host is a new commit no
+  one attested: judge the pull request, not the squashed commit on the default branch.
+
+No runtime dependency. Node 20 or later. Apache-2.0.

package/SECURITY.md

@@ -0,0 +1,105 @@
+# Security
+
+## Reporting a vulnerability
+
+Please report a vulnerability privately, through GitHub's "Report a vulnerability" on this
+repository (Security tab), not in a public issue. Include the version, what an attacker can do,
+and the smallest reproduction you have. You will get an answer within five working days.
+
+A bypass of the rules (a way for an agent or a person to land a change that does not meet them, to
+make a check count that did not run, or to make CI pass a commit it should refuse) is in scope and
+welcome: each one becomes a test.
+
+## The trust model
+
+Trellis has two places, and trusts them differently.
+
+**On a developer's machine**, Trellis runs as the same user as the coding agent it checks. There it
+is a seatbelt for an agent that cuts corners, not a sandbox for one that attacks:
+
+- evidence is recorded by Trellis itself: the gateway runs the tool and sees the answer; the CLI
+  runs the tests; an agent hook records only a call the agent logged (Claude Code) or that passed
+  through the hook;
+- the gateway starts a server of `.mcp.json` only once a person trusted that exact entry
+  (command, arguments, environment, folder) with `trellis mcp trust` in a terminal; an entry a
+  pull request adds or changes is held, so checking out a branch never runs its servers;
+- the evidence log is append-only, each line signed (a per-user key outside the repository) and
+  chained to the one before: an edited, removed or reordered line reads as tampering;
+- a change is read by content (two git trees compared), never by a commit history the agent can
+  shape: a push, a fetch from a side clone, a tag or a rebase does not hide anything;
+- the shell guard (Claude Code, Cursor, Codex, Copilot hooks) refuses what would forge evidence or
+  remove Trellis: reading the key, writing the log or the transcripts, running a hook or
+  `trellis approve` / `checkpoint` / `mcp trust` / `uninstall` / `init` by hand, `git clean -x`, an install
+  without devDependencies, moving a remote-tracking ref, index flags. It reads paths as the shell
+  does, after quotes and escapes;
+- every check fails closed: a log that does not verify, a scanner that could not run, a registry
+  that did not answer, a broken config, a hook whose Trellis is gone (it exits 2) is a finding,
+  never a pass. One is a warning rather than a block: a secret scan that could not run on a
+  developer's machine where the team did not switch gitleaks on; CI, with its own gitleaks, blocks;
+- the attestation of each commit is signed with the developer's ed25519 key.
+
+An agent determined to forge evidence with the user's own permissions can still do it: read the key
+through an indirection the guard does not recognise, write a log line, sign an attestation, or
+run a person's step (`trellis approve`) under a pseudo-terminal through a command the guard does
+not parse (a name assembled at run time). The guard is a list of patterns, not a sandbox. Every hook fails closed when Trellis is missing or
+crashes; Codex's Windows hook is itself a `node -e` line, so without node at all it cannot run,
+and Codex reads that as an error, not a refusal. Code
+that checks itself cannot catch every change to itself. That is why the machine is not the
+authority.
+
+**In CI**, on another machine, `trellis verify --ci` is the authority, provided the pull request
+cannot edit the workflow that runs it: on GitHub, run it on `pull_request_target` (the base
+branch's copy of the workflow runs) and make its check required, as the README's workflow does.
+On `pull_request`, a pull request runs its own copy and can remove the step. No Trellis step runs
+the pull request's code, which is what makes `pull_request_target` safe here; a step added to
+that workflow that does would not be.
+
+- every commit must carry an attestation signed by a key the repository holds (`.trellis/keys/`,
+  committed and reviewed like code), about that exact commit and tree; none, an unknown key, a
+  copied or an `unverified` attestation is refused;
+- the deterministic checks are run again there: the secret scan and every dependency against its
+  registry and OSV;
+- the rules are judged again there, from the commit's own diff and the recorded evidence (an event
+  counts for a file only while the blob it holds is the blob committed). The local verdict is read,
+  never believed.
+
+What CI cannot know is whether a recorded graph query, documentation lookup or test run really
+happened on the developer's machine: those are the heuristic and evidence rules, and the
+attestation's signature only proves they were recorded by someone holding that developer's key.
+They warn by default; the deterministic rules, which CI re-runs itself, are the ones that block.
+The same holds for who made a commit: CI reads "agent" or "person" from the attestation, so an
+agent holding the developer's key can sign its commit as a person's, and the agent rules
+(`tests-protected`, `escalation`) then do not apply to it. The keys, the rules, the allowlist and
+the test commands CI goes by are the base's, so a pull request cannot change them for itself.
+For an untrusted agent, run it in a sandbox, a container or as a separate user, where the key and
+Trellis's code are out of its reach.
+
+**What Trellis does not do**: judge whether a tool was used *well*, see work outside the repository,
+or stop a person from changing the rules (the config and `.trellis/keys/` are reviewed in pull
+requests like the code they protect).
+
+## Privacy
+
+The attestation travels with the repository, so it carries what the repository already shows,
+and digests of the rest. In clear: the paths of the files each check ran on, git object ids, the
+names of the tools called, the agent's self-reported name, the times, and the test command line
+(CI checks it is one of the project's test commands). As SHA-256 only: what a check was about
+(a query, package names, a URL) and each finding's message. The hash is not salted: it keeps the
+text out of sight, not out of reach, since anyone can hash a guess (a package name, a common
+query) and compare. Treat these as names, not secrets. Never: a prompt, a file's content or a
+tool's answer. The local evidence log also holds query subjects in clear (to match a docs
+lookup to a dependency) and stays in the git folder, never pushed.
+
+## Supply chain
+
+- No runtime dependency. abatty is an optional peer dependency, run from the project's own copy.
+- Hooks call the installed script with `node`, never a bare `npx trellis` (an unrelated package on
+  the registry). `.mcp.json` runs the project's copy by path (`node
+  node_modules/@synovitec/trellis/bin/trellis.mjs mcp`); the Cursor, Codex and Copilot configs use
+  `npx --no-install @synovitec/trellis mcp`, which runs the project's copy and never downloads
+  another.
+- Every MCP server Trellis writes is pinned (the Postgres MCP by image digest). The Stop hook runs
+  the pinned AgentShield from an empty folder, so a copy planted in the repository is never run.
+- The GitHub Action pins every action it uses to a commit.
+- Releases are published from CI with npm provenance, by trusted publishing: no publish token is
+  stored anywhere.

package/bin/trellis.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { main } from "../src/cli/main.mjs";
+
+// Commands that use the network return a promise; the others an exit code.
+process.exitCode = await main(process.argv.slice(2));

package/docs/attestation/v0.1.md

@@ -0,0 +1,96 @@
+# Trellis check-evidence predicate, v0.1
+
+Predicate type: `https://github.com/Synovitec/trellis/blob/main/docs/attestation/v0.1.md`
+
+A Trellis attestation says, for one git commit, which of the repository's rules applied, what the
+commit checkpoint concluded, and which checks were seen before it. It is an
+[in-toto Statement v1](https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md) in a
+[DSSE](https://github.com/secure-systems-lab/dsse) envelope (`payloadType`
+`application/vnd.in-toto+json`), signed with the committing developer's ed25519 key, and stored as a
+git note on the commit under `refs/notes/trellis`, one envelope per line (JSON lines). A note is
+only ever added to: two developers' notes on one commit merge line by line
+(`git notes merge -s cat_sort_uniq`), and each line stands or falls on its own signature.
+
+It records what was checked, not who wrote what: it can be linked to attribution records (Git AI
+notes, Agent Trace) and to OpenTelemetry traces, and does not replace them.
+
+## Subject
+
+One resource descriptor: the commit, by its git object ids.
+
+```json
+{ "name": "git commit", "digest": { "gitCommit": "<commit id>", "gitTree": "<tree id>" } }
+```
+
+`gitCommit` and `gitTree` are the in-toto DigestSet names for git object ids (SHA-1 or SHA-256).
+
+## Predicate
+
+```json
+{
+  "verifier": { "name": "trellis", "version": "0.6.0" },
+  "actor": "agent",
+  "agent": "codex",
+  "preset": "recommended",
+  "verdict": "pass",
+  "findings": [{ "rule": "tests-run", "mode": "warn", "messageSha256": "<hex>" }],
+  "events": [
+    { "kind": "graph", "tool": "graphify", "agent": "codex", "at": 1793000000000, "subjectSha256": "<hex>" },
+    { "kind": "tests", "tool": "npm test", "agent": "codex", "at": 1793000060000, "result": 0, "blobs": { "src/a.js": "<blob id>" } }
+  ]
+}
+```
+
+| Field | Meaning |
+| --- | --- |
+| `verifier` | the Trellis version that wrote it |
+| `actor` | `agent` when an agent's work led to the commit (named by a hook, the gateway, or the agent's environment), else `person` |
+| `agent` | the agent's self-reported name, or null; a label, never a security decision |
+| `preset` | the rule preset in force: `recommended`, `strict`, or `unknown` when the checkpoint did not run |
+| `verdict` | `pass` or `fail`: the checkpoint's verdict on exactly the committed tree, from the pre-commit, or from the post-commit when no pre-commit saw the commit (a cherry-pick, a revert, a conflicted rebase, `--no-verify`); `unverified` when the evidence log no longer verified, so nothing could be judged |
+| `findings` | the rules not met at the checkpoint, by rule id and mode, the message as a SHA-256 |
+| `rewrittenFrom` | present on a rebased or amended commit: the commit it was rewritten from. The old attestation is carried over only when the change (each file and the blob it ends with) is exactly the old one's; otherwise the checkpoint runs again on the new commit |
+| `events` | the checks recorded since the previous commit: `kind` (graph, docs, schema, browser, tests, review, plan, approval, escalation), the tool, the agent, the time (ms), an exit code where there is one, the git blob id of each file a content check ran on, and what it was about as a SHA-256 |
+
+In clear: file paths, git object ids, tool names, the agent's name, times, exit codes and the test
+command line (CI checks it is one of the project's test commands). As SHA-256, unsalted (a guess can be
+hashed and compared, so these are names, not secrets): what a check was about and each finding's
+message. Never included: a prompt, a file's content or a tool's answer.
+
+## Verification
+
+`trellis verify --ci --base <commit> [--head <commit>]` checks, for every commit after the base
+up to the head (a pull request's head, never the merge commit a CI checkout builds):
+
+1. a note under `refs/notes/trellis` holds an envelope whose signature verifies with a public key
+   committed under `.trellis/keys/` at the base (a key the range adds is trusted once merged);
+   an envelope that does not verify is skipped, never read as the commit's;
+2. the statement's subject is that commit and its tree;
+3. the verdict is `pass`: `unverified` (nothing could be judged) and `fail` (the checkpoint
+   refused the commit, which was made anyway) are refused;
+4. Trellis's own secret scan and dependency checks, run again on the commit's diff, pass;
+5. the rules, judged again from the commit's diff and the recorded events (an event counts for a
+   file only while the blob it holds is the blob committed), pass. A merge commit's diff is its
+   own part: the files that differ from every parent. What each side brought is judged on its
+   own commits, which are in the range;
+6. the range's net change (what merging the head into the base gives, by `git merge-tree`, git
+   2.38 or later; else the head against every merge base) holds only content a
+   commit of the range produced: a file a merge took from elsewhere (an old ancestor of the base,
+   a branch outside the range) was judged by no one, and is refused;
+7. that net change, judged as one change against the base, meets the deterministic rules and
+   tests-protected (the agent rules over the files an agent's commit made, with the approvals the
+   range recorded): a branch from an old ancestor can "add" a test the base already has, or keep a
+   dependency the base upgraded, which against the base is an edit and a downgrade.
+
+The local verdict is read, never believed: points 4 and 5 are the verifier's own judgement. The
+result can be written as a SLSA `verification_summary/v1` (no SLSA level is claimed:
+`SLSA_BUILD_LEVEL_UNEVALUATED`), whose subjects are each commit as the SHA-256 of its raw object
+(`git cat-file commit <id> | sha256sum`), so that SHA-256-only tooling such as GitHub artifact
+attestations can sign it.
+
+## Trust
+
+A developer's signature proves the attestation was not altered after Trellis wrote it on that
+developer's machine. It does not prove that an agent running as the same user did not write it:
+that is why CI re-runs the deterministic checks and re-judges the rules. See
+[SECURITY.md](../../SECURITY.md).

package/package.json

@@ -1,6 +1,80 @@
 {
   "name": "@synovitec/trellis",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.6.0-rc.3",
+  "description": "Proof that a change got the checks your repository asks for, whoever made it: AI coding agents (Claude Code, Cursor, Codex, Copilot, any MCP agent) and people, held at the commit and verified again in CI with signed in-toto attestations.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Synovitec/trellis.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Synovitec/trellis/issues"
+  },
+  "keywords": [
+    "developer-experience",
+    "coding-agents",
+    "mcp",
+    "tooling",
+    "doctor",
+    "gitleaks",
+    "osv-scanner",
+    "playwright",
+    "abatty",
+    "claude-code",
+    "agent-hooks",
+    "ai-agents",
+    "guardrails",
+    "graphify",
+    "context7",
+    "postgres-mcp",
+    "attestation",
+    "in-toto",
+    "slsa",
+    "provenance",
+    "mcp-server",
+    "cursor",
+    "codex",
+    "github-copilot",
+    "pre-commit",
+    "supply-chain"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "trellis": "bin/trellis.mjs"
+  },
+  "exports": {
+    ".": "./src/index.mjs",
+    "./tools": "./src/tools/registry.mjs",
+    "./schema": "./schema/trellis.config.schema.json"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "schema/",
+    "docs/attestation/",
+    "README.md",
+    "CHANGELOG.md",
+    "SECURITY.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node scripts/test.mjs \"test/*.test.mjs\"",
+    "trellis": "node bin/trellis.mjs",
+    "doctor": "node bin/trellis.mjs doctor"
+  },
+  "peerDependencies": {
+    "abatty": ">=0.8.1"
+  },
+  "peerDependenciesMeta": {
+    "abatty": {
+      "optional": true
+    }
+  }
+}