Trust chain
1
Build
Artifact generated in a CI pipeline.
2
Digest
Digest computed from the package payload.
3
Sign
Signature produced through Cosign/Sigstore.
4
Verify
Registry verifies the signature against organizational trust policy.
Access control
- JWT validation at the request boundary
- Scope checks against the caller’s permissions manifest
- Optional tenant boundary enforcement via audience and tenant claims
- Visibility/sharing filter on search and metadata endpoints (per-request, never cached in the index)
- Guardrail policy is readable by any tenant member, writable only by a tenant admin
Auditability
- Immutable publish events record actor, digest, and policy verdict
- Retrieval events record a hashed caller identity and skill reference
- Publish events additionally record
guardrail_warning_ids— which non-blocking checks fired, even though they didn’t stop the publish — so a tenant can audit warning trends from the log alone