CodeInstances Signs Runs So Anyone Can Check Who Kept Them

CodeInstances 0.7 adds signing. Every kept run already carried a SHA-256 id that showed when a file had been edited, but not who made it, since anyone can edit a run and write a new id. Now codeinstances keygen makes an Ed25519 key pair, sign (or record -sign) vouches for a run with it, and verify -trust ci.pub exits 0 only when that key signed that exact run. The release post has the details, and binaries are out for Linux, macOS and Windows.

A signature covers the run’s content id, the id it had before anyone signed it, so a CI runner and a reviewer can both sign one run. Older versions still read signed files. A store started with serve -trust takes only signed runs, and pull -trust keeps only those. Useful wherever a run is evidence: a CI result, an AI agent’s actions, a bug report.

An independent review tried to forge a trusted signature and couldn’t. It did find a signature that could be spelled more than one way, a sign that could drop data from newer files, and a CI example that left the key where the tests could read it, all fixed and tested. 110 Go tests pass with a clean race detector run, and in the demo signing a run took 6 ms and checking it 3 ms. Running instances on demand, the optional last step, is all that’s left on the plan.