The trust corpus
These listed GitHub Action reports have Sigstore keyless signatures and public Rekor entries. Verify each bundle and its workflow identity independently; a signature does not establish correctness, security, audit or human approval.
5 attestations so far. This is a curated list; Action signing occurs only when a spec report exists and id-token: write is granted.
326f8ebf518592bd·2026-04-25T16:05ZMarketing showcase PR — signed Action report for a set of breaking API changes
0848cba509bffb35·2026-04-25T12:55Z@v1 floating-tag verification — first attestation produced by a consumer pinned to plain @v1 (now resolves to v1.11.3)
c99a3231dee4eaef·2026-04-25T06:14Zv1.11.2 dogfood — workflow binding card + run-URL surface
c9a8a56ab9f0788b·2026-04-25T05:56Zv1.11.1 dogfood — Breaking Changes table now shows ALL breaking changes
10d658b04e8e3bd2·2026-04-25T05:41Zv1.11.0 dogfood — first signed Delimit attestation on a real PR
Verify any entry yourself
Click any attestation above to land on its /att/<id> page. From there you can copy the cosign verify-blob command, download the signed bundle from the workflow run, and run the verification locally — no Delimit account, no API key, no web call to delimit.ai.
Rekor provides a public record for these signed bundles. Verification still requires checking the bundle and expected identity; the signature proves provenance of the recorded evidence, not the quality of the change.