Attestations

What is an attestation?

When wrap produces an attestation, it saves a structured JSON bundle with a local HMAC signature. It records the wrapped command, captured git state, changed files, checks that ran and policy violations when available. The record depends on the evidence actually captured. The schema is delimit.attestation.v1.

Attestations are HMAC-SHA256 signed locally with a per-install key at ~/.delimit/wrap-hmac.key. Each attestation gets an ID of the form att_xxx (first 16 chars of the SHA-256 of the canonical bundle) and is persisted to ~/.delimit/attestations/<id>.json.

Anatomy of an attestation

{
  "id": "att_7d556843c84fb881",
  "bundle": {
    "schema": "delimit.attestation.v1",
    "kind": "merge_attestation",
    "wrapped_command": "claude -p \"add a nullability check to User.email\"",
    "before_head": "52ff636f5e84eb70e30be20deb72b69a4118daf7",
    "after_head":  "a7bf9e12c4fa5e2b18d3c7f0b9e4a2d5f8c1e6a3",
    "started_at":  "2026-04-23T02:08:39.417Z",
    "completed_at":"2026-04-23T02:08:39.442Z",
    "wrapped_exit": 0,
    "changed_files": ["app/models/user.ts"],
    "governance": {
      "gates": [
        { "name": "diff", "files": 1 },
        { "name": "test_smoke", "runner": "npm test", "exit": 0 }
      ],
      "violations": [],
      "advisory": true
    },
    "delimit_wrap_version": "1.1.0"
  },
  "signature": "e98a9304ba184ade0ecea67bd73961c4d507fe89db3ce70470774ca3a45ce8ee",
  "signature_alg": "HMAC-SHA256"
}

Notice what is NOT here: the prompt text, the model's raw response, the source code. The attestation captures the fact of what happened (plus the git diff pointer and governance results), not the content. This is the same posture as a Sigstore signature on a build artifact.

Attestation kinds

{
  "id": "att_2d25f919221a3b05",
  "bundle": {
    "schema": "delimit.attestation.v1",
    "kind": "liability_incident",
    "wrapped_command": "claude -p \"refactor the auth middleware\"",
    "wrapped_exit": 137,
    "kill_switch": {
      "kind": "timeout",
      "max_time_seconds": 60,
      "signal": "SIGKILL",
      "handoff_suggestion": {
        "kill_source": "claude",
        "handoff_target": "codex",
        "suggested_command": "delimit wrap -- codex -p \"refactor the auth middleware\"",
        "alternates": ["codex", "gemini", "cursor"]
      }
    }
  },
  "signature": "..."
}

curl -sL -o receipt.json https://delimit.ai/attestations/d83671c48a20625e.json
npx -y delimit-cli seal-verify receipt.json

Verifying a signature

A local wrap receipt can be verified by someone with its per-install HMAC key; that key is not public. The signature covers the canonical JSON-serialized bundle object (keys sorted). To verify:

python3 -c "
import hmac, hashlib, json
att = json.load(open('~/.delimit/attestations/att_xxx.json'.replace('~', '$HOME')))
key = open('$HOME/.delimit/wrap-hmac.key','rb').read()
canon = json.dumps(att['bundle'], sort_keys=True)
expected = hmac.new(key, canon.encode(), hashlib.sha256).hexdigest()
print('verified' if expected == att['signature'] else 'TAMPERED')
"

For public verification, use a Sigstore-signed Action report or a separately published Ed25519 release receipt. Local delimit wrap attestations remain HMAC-signed for offline use.

Replay URLs

Local delimit wrap attestations stay on your machine. Hosted replay for local wrap attestations is not available yet: the CLI reports not uploaded (local attestation only). Pages under https://delimit.ai/att/ currently host published Delimit release receipts, such as the v4.7.2 sample above.

Use delimit trust-page -o ./trust to render an offline-viewable static HTML page + JSON Feed 1.1 from a directory of attestations — deploy wherever you want (GitHub Pages, S3, Vercel, your own infra).

AI-SBOM: attestations as a bill of materials

delimit ai-sbom aggregates a directory of attestations into a CycloneDX 1.6 bill of materials with AI-specific fields. Detected model vendors become components; tool-call surface, policy gate counts, and violation counts become metadata properties. The result is the SBOM format enterprise procurement already accepts, extended with the AI surface it now asks about.

delimit ai-sbom -o ./ai-sbom.json
#   attestations scanned: 47
#   models detected:      4 (anthropic/claude, openai/gpt, google/gemini, cursor/cursor-agent)
#   total gates run:      187
#   total violations:     3