attestation

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

The black box for AI-written code. Passive decision graph linking every commit to the agent prompts behind it: drift detection, DLP audit of what agents read, evidence-driven risk, MCP memory for coding agents, signed provenance attestations. One command, offline by default.