opentine v0.15.0: verifiable evidence, serverless sharing

opentine v0.15.0 is available on GitHub and PyPI. The release makes evidence portable in two new ways: signed in-toto provenance binds a statement to a run digest, and a verified bundle moves refs and their objects without an opentine server.

Sign the evidence, not the conversation

tine export result.tine --format intoto --ed25519-key-file agent.key --output result.intoto.jsonl
tine verify result.tine --attestation result.intoto.jsonl --pubkey agent.key.pub --json

The DSSE envelope carries an in-toto Statement v1. Its subject is the run's recomputed SHA-256 digest. Status, model/provider identities, lineage, usage and cost totals, and an agent ref describe the run without including prompts, completions, or tool payloads. An unsigned statement is never written.

An Ed25519 did:key identifies a key rather than its owner. Trust still comes from an operator-selected public key or pin. Embedded-key trust is reported as verified-tofu.

Receipts and keyless identity

Explicit Rekor publication adds a transparency receipt in a Sigstore bundle. Offline verification checks the signed timestamp, inclusion proof, checkpoint, and envelope binding. --require-receipt fails when that evidence or its trusted log key is absent or invalid.

Keyless signing uses a short-lived Fulcio certificate for an OIDC identity and always logs to Rekor. Verification requires the expected certificate identity and issuer plus trusted Fulcio and Rekor roots. The identity token is never printed or persisted.

Share a run through files or git

tine bundle create review.tinebundle --all --repo .
tine bundle verify review.tinebundle
tine bundle unbundle review.tinebundle --as reviewer --repo .

A bundle contains the transfer pack, a canonical ref manifest, and a SHA-256 covering the bundle. Import verifies before moving remote-tracking refs, does so atomically, and refuses a non-descendant update unless forced. Integrity is separate from authorship; attach signed evidence when authenticity matters.

tine bundle push and fetch store the same bundle at refs/tine/bundle on an ordinary git remote. GitHub, Gitea, a bare repository, or a local path can carry the evidence.

The foundation shipped between v0.10 and v0.15

Action queries now connect commands, programs, paths, hosts, and MCP calls to agent identities. Signed action manifests and policy audits expose their trust state. Git trailers and notes connect runs to commits; blame, bisect, worktrees, and bounded fan-out make history actionable.

Compressed artifacts, verified packs, footprint inspection, dry-run pruning, and archives keep long-lived repositories manageable. Auto-packing now controls recording bursts and coalesces the recorder's packs at finalize. The release also hardens MCP rendering, private files, adapter loading, and Windows replacement races.

Compatibility has more than one number

Portable payloads remain v2 and repository objects remain v3, while compressed storage needs newer readers. Descriptor v2 requires v0.11; the optional storage-v3 upgrade requires v0.13. New catalog signatures require v0.12. Current releases read data back to v0.3, but older installations can refuse newer storage.

python -m pip install --upgrade "opentine==0.15.0"

Read the upgrade guide, storage compatibility table, provenance guide, and bundle reference. v0.16's command groups and named trust policies are unreleased work on main.