Verify

Check what this system says about itself

The Starlight Intelligence System publishes a small profile about itself, runs an open checker on it, and signs the result in CI. Below is that receipt: what is claimed, what was checked, who signed it, and how to check it yourself without trusting this site.

This receipt is self-attested. The repository checks and signs its own profile. It is not third-party certification, and it says nothing about adoption or users.

Receipt · sip-conform@0.1.0

Pass · built from main

This page was built from main. CI signs these exact bytes whenever the profile or the checker changes on main. The verify command below confirms the signature without trusting this site.

Artifact: protocol/profiles/sis.json
14 nodes, 10 edges, 1 projection, all public. Declared by Frank Riemer (GitHub: frankxai).
sha256acac2fd23be17010ac9a4ea853aa40ef97c2fb0b4583f66b0cfe056ca5c5fd8a
Check that ran: sip-conform@0.1.0 against SIP graph v0.1.0 (profile declares v0.1.0). 17 rules on graph structure, version compatibility, and what a public projection may show. The same check runs in sip-self-receipt.yml before anything is signed.
Verdict: PASS · 17 of 17 rules passed
Signer: GitHub Actions workflow .github/workflows/sip-self-receipt.yml on refs/heads/main, signing keyless through Sigstore with a GitHub OIDC identity. No long-lived key is involved. The signature covers the file's sha256; the receipt is the signed payload.
Timestamp: Receipt recomputed 2026-09-19 04:41 UTC when this page's copy was generated. The signing time is in the public Rekor transparency log; the verify command prints it with --format json.
Verify it yourself: verify command
gh attestation verify sis.json \ --repo frankxai/Starlight-Intelligence-System \ --predicate-type https://starlightintelligence.org/protocol/receipt/v0.1.0 \ --signer-workflow frankxai/Starlight-Intelligence-System/.github/workflows/sip-self-receipt.yml \ --source-ref refs/heads/main
Run it on a copy of the file (step 1 below). Exit code 0 means the signature is valid, the signer is that workflow on main, and the digest matches.

What is claimed

The profile makes 3 claims. Each one points to a source pinned to a commit, so you can check it by reading one file.

Protocol suite runs on Node 18, 20 and 22
CI runs the protocol test suite (protocol/test/conform.test.mjs, protocol/test/sign.test.mjs), the reference-passes/leaky-fails fixture check and an end-to-end sign-and-verify on Node 18, 20 and 22, for pull requests to main and pushes to main that touch protocol/ or the workflow.
Check against Protocol CI workflow @ 72a84693be9b
The Built on SIP block is a declared label, not a signature
The 'Built on SIP' block is a declared label, not a signature, and is emitted only when an artifact composes a SIP element. A claim a stranger can verify needs a signed receipt, checked with protocol/verify.mjs --profile.
Check against ATTESTATIONS.md, entry 2026-09-19 @ 72a84693be9b
The protocol toolchain has no dependencies
protocol/conform.mjs, sign.mjs, verify.mjs and protocol/lib/*.mjs import only node: built-in modules and each other; nothing is installed to run them.
Check against protocol/README.md @ 72a84693be9b

What was checked

The checker tests the profile's structure. Whether the claims are true is checked against their sources. These are the rules and their results for the bytes above.

PassC1
Declared graph version is compatible
PassG1
Every node and edge carries the governance envelope
PassG2
Ids are namespaced and match their type
PassG3
Ids are unique across nodes and edges
PassG4
Node types are drawn from the declared set
PassG5
Edge types are drawn from the declared set
PassG6
Edge endpoints resolve to declared nodes
PassG7
Edge endpoints match the legal type matrix
PassG8
Every element is owned by a declared Identity
PassG9
Provenance sources resolve inside the graph
PassG10
derivedFrom contains no cycles
PassG11
Node bodies carry their type's required fields
PassP1
Projections never widen a node or edge past its visibility
PassP2
Boundary-crossing edges are declared as redacted
PassP3
Owner-only fields are stripped or explicitly redacted, at any depth
PassP4
No credential-shaped value reaches a public projection
PassP5
Publicly projected nodes name a publicly resolvable owner

Verify it yourself

1
Step 1: Get the file and hash it
download command
```
curl -sSLo sis.json https://raw.githubusercontent.com/frankxai/Starlight-Intelligence-System/main/protocol/profiles/sis.json
sha256sum sis.json    # macOS: shasum -a 256 sis.json
```
The hash should equal the sha256 in the receipt above. If the profile changed on main after this page was built, the hash differs and the new bytes get their own signature.

Step 2: Check the signature

verify command

gh attestation verify sis.json \
  --repo frankxai/Starlight-Intelligence-System \
  --predicate-type https://starlightintelligence.org/protocol/receipt/v0.1.0 \
  --signer-workflow frankxai/Starlight-Intelligence-System/.github/workflows/sip-self-receipt.yml \
  --source-ref refs/heads/main

Needs the GitHub CLI. Add --format json to see the signed receipt and the transparency log entry. All attestations for the repository are listed on its attestations page.

3
Step 3: Re-run the check
re-check commands
```
git clone --depth 1 https://github.com/frankxai/Starlight-Intelligence-System.git
cd Starlight-Intelligence-System
node protocol/conform.mjs protocol/profiles/sis.json
```
Node 18 or later, nothing to install. The checker prints the same verdict, and the sha256 it prints equals the signature's subject digest.
Step 4: Read the sources
The signature and the check say nothing about whether the claims are true. Open each source listed under What is claimed at its pinned commit.

What this proves, and what it does not

A valid signature proves

These exact bytes were checked by this repository's CI on main and passed.
The signed receipt is recorded in a public transparency log.
Anyone can re-run the same check offline.

It does not prove

That the claims are true. The sources are for that.
Review by anyone outside this repository.
Adoption, users, or use by other projects.

Background: the protocol page and the profile README, which describes how the attestation is made.

Check what this system says about itself

This receipt is self-attested. The repository checks and signs its own profile. It is not third-party certification, and it says nothing about adoption or users.

gh attestation verify sis.json \ --repo frankxai/Starlight-Intelligence-System \ --predicate-type https://starlightintelligence.org/protocol/receipt/v0.1.0 \ --signer-workflow frankxai/Starlight-Intelligence-System/.github/workflows/sip-self-receipt.yml \ --source-ref refs/heads/main

What is claimed

The profile makes 3 claims. Each one points to a source pinned to a commit, so you can check it by reading one file.

Protocol suite runs on Node 18, 20 and 22
CI runs the protocol test suite (protocol/test/conform.test.mjs, protocol/test/sign.test.mjs), the reference-passes/leaky-fails fixture check and an end-to-end sign-and-verify on Node 18, 20 and 22, for pull requests to main and pushes to main that touch protocol/ or the workflow.
Check against Protocol CI workflow @ 72a84693be9b
The Built on SIP block is a declared label, not a signature
The 'Built on SIP' block is a declared label, not a signature, and is emitted only when an artifact composes a SIP element. A claim a stranger can verify needs a signed receipt, checked with protocol/verify.mjs --profile.
Check against ATTESTATIONS.md, entry 2026-09-19 @ 72a84693be9b
The protocol toolchain has no dependencies
protocol/conform.mjs, sign.mjs, verify.mjs and protocol/lib/*.mjs import only node: built-in modules and each other; nothing is installed to run them.
Check against protocol/README.md @ 72a84693be9b

What was checked

The checker tests the profile's structure. Whether the claims are true is checked against their sources. These are the rules and their results for the bytes above.

PassC1
Declared graph version is compatible
PassG1
Every node and edge carries the governance envelope
PassG2
Ids are namespaced and match their type
PassG3
Ids are unique across nodes and edges
PassG4
Node types are drawn from the declared set
PassG5
Edge types are drawn from the declared set
PassG6
Edge endpoints resolve to declared nodes
PassG7
Edge endpoints match the legal type matrix
PassG8
Every element is owned by a declared Identity
PassG9
Provenance sources resolve inside the graph
PassG10
derivedFrom contains no cycles
PassG11
Node bodies carry their type's required fields
PassP1
Projections never widen a node or edge past its visibility
PassP2
Boundary-crossing edges are declared as redacted
PassP3
Owner-only fields are stripped or explicitly redacted, at any depth
PassP4
No credential-shaped value reaches a public projection
PassP5
Publicly projected nodes name a publicly resolvable owner

Verify it yourself

1
Step 1: Get the file and hash it
download command
```
curl -sSLo sis.json https://raw.githubusercontent.com/frankxai/Starlight-Intelligence-System/main/protocol/profiles/sis.json
sha256sum sis.json    # macOS: shasum -a 256 sis.json
```
The hash should equal the sha256 in the receipt above. If the profile changed on main after this page was built, the hash differs and the new bytes get their own signature.

Step 2: Check the signature

verify command

gh attestation verify sis.json \
  --repo frankxai/Starlight-Intelligence-System \
  --predicate-type https://starlightintelligence.org/protocol/receipt/v0.1.0 \
  --signer-workflow frankxai/Starlight-Intelligence-System/.github/workflows/sip-self-receipt.yml \
  --source-ref refs/heads/main

Needs the GitHub CLI. Add --format json to see the signed receipt and the transparency log entry. All attestations for the repository are listed on its attestations page.

3
Step 3: Re-run the check
re-check commands
```
git clone --depth 1 https://github.com/frankxai/Starlight-Intelligence-System.git
cd Starlight-Intelligence-System
node protocol/conform.mjs protocol/profiles/sis.json
```
Node 18 or later, nothing to install. The checker prints the same verdict, and the sha256 it prints equals the signature's subject digest.
Step 4: Read the sources
The signature and the check say nothing about whether the claims are true. Open each source listed under What is claimed at its pinned commit.

What this proves, and what it does not

A valid signature proves

These exact bytes were checked by this repository's CI on main and passed.
The signed receipt is recorded in a public transparency log.
Anyone can re-run the same check offline.

It does not prove

That the claims are true. The sources are for that.
Review by anyone outside this repository.
Adoption, users, or use by other projects.

Background: the protocol page and the profile README, which describes how the attestation is made.

Check what this system says about itself

What is claimed

Protocol suite runs on Node 18, 20 and 22

The Built on SIP block is a declared label, not a signature

The protocol toolchain has no dependencies

What was checked

Verify it yourself

Step 1: Get the file and hash it

Step 2: Check the signature

Step 3: Re-run the check

Step 4: Read the sources

What this proves, and what it does not

A valid signature proves

It does not prove

Check what this system says about itself

What is claimed

Protocol suite runs on Node 18, 20 and 22

The Built on SIP block is a declared label, not a signature

The protocol toolchain has no dependencies

What was checked

Verify it yourself

Step 1: Get the file and hash it

Step 2: Check the signature

Step 3: Re-run the check

Step 4: Read the sources

What this proves, and what it does not

A valid signature proves

It does not prove