Attestations now require a verified signature and there is no unsigned path to one. Commits still take an author's word for who made them, so provenance is verified at settlement and merely declared at creation. Closing it means threading a signer through Repo::commit, which every caller touches. Open question: does a commit signature buy enough over an attestation signature to be worth that, given the gate only ever consults attestations?
reading the history…
Check your own understanding
Questions about this decision, asked of you. Nothing here is stored, scored, or able to settle anything — only a signature does that.
Only a person can sign here: in the code, no attestation constructor accepts an agent — the compiler proves it. Identity is declared, not authenticated; signing is named future work.
Signing happens on your machine
An attestation is only an attestation because a key signed it, and the key never leaves the machine it lives on — not even to this page. Draft the words here if it helps; sign them with jac.
jac attest 875b5aaab644… -m "what you read, and what you are accepting"
Select any sentence above to say something about it. A suggestion can become a decision; the gate can only enforce decisions.
Nothing raised here yet. Select a sentence to say something about it.