Witness

Every release you ship carries fixes that can silently regress. Witness generates a cryptographically signed manifest that maps each documented fix to a file and a marker substring, then tracks how that population evolves across commits in a temporal JSONL log. When something breaks again, you can pinpoint the exact commit that reintroduced it instead of guessing. It's built around Ed25519 signatures derived from your git commit, so verification works without storing private keys. Ruflo itself uses this in CI to gate publishes. You can drop the toolkit into any project, register your fixes in a JSON file, and wire regen into your release pipeline. The history queries are the real payoff: you get a bisectable timeline of what regressed when.

skills.sh installs: 656
GitHub stars: 81.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add ruvnet/ruflo --skill witness --agent claude-code

Installs into .claude/skills of the current project.

Files

Witness — tamper-evident fix-regression tracking

The witness toolkit lets you ship every release with a signed manifest that lists every documented fix in your codebase along with a sha256 + marker substring. By default the signing seed is derived from the public git commit, so anyone can reproduce the signature: this is an integrity checksum, not proof of authorship. For authenticity, sign with a 32-byte RUFLO_WITNESS_SEED and verify with a pinned RUFLO_WITNESS_PUBLIC_KEY.

A temporal history (JSONL) tracks how the fix population evolves across releases — so when a regression appears, you can pinpoint the commit that introduced it, not just "it's broken now."

This skill works two ways:

Inside ruflo — used by ruflo's own CI to gate publishes (see .github/workflows/v3-ci.yml job witness-verify).
In your own project — copy plugins/ruflo-core/scripts/witness/ into your repo, run init.mjs, register your fixes in witness-fixes.json, and call regen.mjs from your release pipeline.