Software supply-chain security · 2026 · Solo — research, security architecture, interaction design, build, verification
Attest Lens
Tamper one build claim, verify the envelope, and see exactly where the release chain fractures.
The problem
A valid signature answers only one release question. Security engineers must also bind provenance to the artifact bytes they received and decide whether signer, issuer, repository, builder, and revision satisfy local policy. Those checks are often scattered across CLI output and JSON. Attest Lens compresses them into one bounded, inspectable experiment without claiming Cosign, Sigstore-service, or SLSA-certification parity.
Architecture
Key decisions
Keep cryptographic integrity separate from trust policy
A modified artifact leaves the signed payload intact, so signature verification passes while subject binding fails. A modified signed claim breaks the signature and its matching policy predicate. The interface makes those different failure modes explicit.
Fail closed through independent evidence receipts
Promotion opens only after envelope shape, ECDSA signature, artifact digest, and every provenance predicate pass. No green summary can hide a failed upstream invariant.
Use a real cryptographic boundary without trust theater
The demo uses Web Crypto and a pinned local P-256 key, but labels its bounded fixture and exclusions. It does not call Sigstore services, validate certificates or transparency proofs, or certify a SLSA level.
Make publication evidence transactional
The private product repository is separate from this portfolio site. GitHub commit status tied the pushed main-branch SHA to the Ready Vercel deployment before this case study was added; production behavior, English, focus, responsive screenshots, and zero browser errors passed independently.