Don't trust us. Check it.

1. A publisher adds the certifier to their CI

   The artifact (a skill, MCP server or ruleset) lives in the publisher's public repository. They call workrr's open certifier workflow from their own GitHub Actions. workrr never receives or hosts their code.

   jobs:
     certify:
       permissions: { contents: read, id-token: write, attestations: write }
       uses: workrr-trust/certify/.github/workflows/certify.yml@v0.1.5
       with: { path: skills/my-skill }

   The certifier workflow (v0.1.5)A real caller

2. The certifier runs four checks

   Provenance: the artifact is committed and unchanged at a known commit. Policy: it conforms to a named, digest-pinned policy. Known-pattern scan: no high or critical findings from a pinned ruleset. Tests: the artifact's own test suite passes. The artifact's tests run in a separate job that has no permission to sign anything, so a malicious artifact can't get anything signed as workrr.

   Checks in the specCheck source code

3. It's signed keylessly and logged in public

   If every check passes, the result is signed through Sigstore using the CI job's own identity. There's no long-lived workrr signing key to steal. The signing identity is the certifier workflow at a release tag, and every signature is recorded in Rekor, a public append-only log run by the open-source community.

   First certificate in RekorSigning in the spec

4. A public ledger records and watches it

   The ledger discovers new certificates automatically and indexes them by artifact digest. Every hour it checks that Rekor's log has only been appended to, never rewritten. Once a day it timestamps its latest checkpoint into Bitcoin through OpenTimestamps. A GitLab copy independently re-checks the log and only ever moves forward, so a rewrite on GitHub would be caught.

   Live ledger viewLedger on GitHubMirror on GitLab

5. Anyone verifies it, without asking us

   The open verifier re-hashes the artifact and checks the Sigstore signature, the Rekor inclusion proof and the signer identity. Two independent implementations (TypeScript and Go) must agree byte for byte.

   npx @workrr-trust/certify verify ./my-skill --bundle certificate.sigstore.json

   Verify it yourselfStep-by-step guide

# 1. Get the artifact and its certificate
git clone https://github.com/workrr-trust/sample-skills && cd sample-skills
gh run download 39318231388 --repo workrr-trust/sample-skills -n workrr-certificate -D cert

# 2. Verify with the npm package…
npx @workrr-trust/certify verify skills/csv-summary --bundle cert/certificate.sigstore.json

# …or the Go implementation
go install github.com/workrr-trust/certify/go/cmd/workrr@v0.1.5
workrr verify skills/csv-summary --bundle cert/certificate.sigstore.json

# 3. Audit the whole ledger, including the GitLab mirror
git clone https://github.com/workrr-trust/ledger && cd ledger
MIRRORS=https://gitlab.com/workrr-trust/ledger.git bash scripts/audit.sh

Change one byte of the skill and run step 2 again: verification fails, because the certificate covers that exact content.