witness — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited witness (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The witness toolkit lets you ship every release with a signed manifest that lists every documented fix in your codebase along with a sha256 + marker substring. Anyone with the same git commit can re-derive the public key and verify the signature without a committed private key.
A temporal history (JSONL) tracks how the fix population evolves across releases — so when a regression appears, you can pinpoint the commit that introduced it, not just "it's broken now."
This skill works two ways:
.github/workflows/v3-ci.yml job witness-verify).
plugins/ruflo-core/scripts/witness/into your repo, run init.mjs, register your fixes in witness-fixes.json, and call regen.mjs from your release pipeline.
# One-time bootstrap — creates verification.md.json,
# verification-history.jsonl, and witness-fixes.json template
node plugins/ruflo-core/scripts/witness/init.mjs --root .
# Edit witness-fixes.json: add { id, desc, file, marker } per fix.
# A "marker" is a distinctive substring that MUST appear in `file`
# while the fix is present. If someone reverts the fix, the marker
# disappears and `verify` reports it as `regressed`.
# Regenerate the manifest (signs with Ed25519 from current gitCommit)
npm i @noble/ed25519
node plugins/ruflo-core/scripts/witness/regen.mjs \
--manifest verification.md.json \
--history verification-history.jsonl \
--fixes witness-fixes.json
# Verify markers are present in the live tree
node plugins/ruflo-core/scripts/witness/verify.mjs \
--manifest verification.md.json# Latest snapshot vs. previous
node plugins/ruflo-core/scripts/witness/history.mjs \
--history verification-history.jsonl summary
# For each currently-regressed fix, find the commit that introduced it
node plugins/ruflo-core/scripts/witness/history.mjs \
--history verification-history.jsonl regressions
# Status timeline for a specific fix
node plugins/ruflo-core/scripts/witness/history.mjs \
--history verification-history.jsonl timeline --id F1
# Machine-readable for CI
node plugins/ruflo-core/scripts/witness/history.mjs \
--history verification-history.jsonl summary --jsonsummary exits non-zero if any fix newly regressed since the last snapshot — drop it in CI as a soft pre-merge gate.
regen.mjs,otherwise the signature breaks.
'function', 'import') — pick somethingunique enough that grep doesn't false-positive against unrelated code.
--history, you lose theability to bisect when a regression was introduced.
verification.md.json andverification-history.jsonl belong in the same commit; the JSONL is what lets future you verify the signed manifest is the latest in the line.
scripts/witness/lib.mjs — shared regenerate / history logic.scripts/witness/regen.mjs — CLI: sign + append history.scripts/witness/history.mjs — CLI: query the temporal log.scripts/witness/init.mjs — CLI: bootstrap into a fresh project.scripts/witness/verify.mjs — CLI: validate signature + markers.v3-ci.yml job witness-verify runs after the behavioral smoke tests and before publish. Failure modes:
| Failure | Cause |
|---|---|
signatureValid: no | manifest hand-edited; re-run regen |
regressed: > 0 | a documented fix lost its marker since issuance |
missing: > 0 | a cited dist file no longer exists; rebuild or remove the entry |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.