Who reviewed this commit, and how sure were they?

augur gives you a number. attest is where that number, and who stood behind it, gets written down.

Every change in a repo was reviewed by someone or something, at some level of confidence. Most of the time that fact evaporates. The PR merges, the approval scrolls out of view, and six months later nobody can tell you whether a commit was carefully vetted or rubber-stamped at midnight. With agents writing and approving code, that gap gets worse, not better. I wanted the answer to live on the commit itself.

So attest records it. Each attestation says who or what reviewed a specific SHA (human:leif, agent:claude), at what confidence from 0 to 1, with an optional verdict, whether tests passed, whether a human signed off, and a timestamp. It captures the augur verdict directly: attest sign --from-augur - reads augur's JSON, so a risk-45 diff becomes a 0.55-confidence attestation, and the score that informed the decision is recorded next to the decision.

It lives in the repo, not a service

The ledger is stored in git notes, under refs/notes/attest. There is no database, no service, no third party to trust. The trust record travels with the code across every host, and you sync it the way you sync anything in git. It is append-only and you can verify it offline. Run attest keygen once and sign with an Ed25519 key, and anyone can check the signature against a canonical serialization. An unsigned attestation is still a valid record, so you can start with zero setup and add signing later.

A gate, not just a log

A record you can ignore is not worth much, so attest is also a contract. A .attest.json policy declares what a commit must carry: an attestation at all, passing tests, a signature, a human sign-off above a given risk verdict. attest verify exits non-zero when the policy is not met, which is the line a CI job or an agent loop gates on. augur decides how risky a change is. attest decides whether it has been vetted enough to ship, and remembers that forever.

The provenance half

augur and attest are a pair. One scores the change, the other records who accepted it and how sure they were, and both gate a human and an agent with the same rules. In a flock where code comes from people and models in roughly equal measure, I want to ask any commit a simple question and get a real answer: who reviewed this, and how sure were they? attest is how the answer survives.