Sovereign Integrity & Governance Interface Layer

SIGIL

Open-source control and evidence for software that lets language models call tools.

SIGIL puts signed policy, deterministic validation, and portable proof receipts around model-driven actions. It runs inside your infrastructure and requires no SIGIL service.

View source Read the receipt spec

The model proposes. Code decides. The receipt proves what the software recorded.

01 / CONTROL PATH

The gap is between decision and effect

A model can propose an action. Ordinary code decides whether that action reaches a tool. SIGIL signs the governing instruction, checks each proposal against declared capabilities and effect classes, then records evidence around the decision and outcome.

  1. 1 Seal Sign the instructions, capabilities, schemas, effects, and expiry.
  2. 2 Verify Reject altered, expired, revoked, or wrongly signed policy.
  3. 3 Gate Resolve capabilities and recheck parameters before dispatch.
  4. 4 Record Persist signed decisions and outcomes against the measured runtime.

02 / PRIMITIVES

What ships

Signed governance

Ed25519 seals bind exact instructions to allowed tools, effect classes, parameter rules, output schemas, identities, and expiry.

Deterministic tool gate

Opaque capability IDs resolve through ordinary Python. Validation runs again at dispatch so stale approval cannot bypass the final check.

Action receipts

Portable Ed25519 receipts commit to the action, decision, policy, measured runtime, chain position, delegation, and evidence digests.

Selective disclosure

Salted Merkle commitments let a holder reveal selected receipt fields while keeping arguments, outputs, credentials, and other fields private.

Signed audit chain

Hash-linked, signed entries expose edits, deletions, reordering, and signature stripping under a pinned public key.

MCP trust wrapper

The reference stdio wrapper filters discovery, gates each tool call, writes preauthorization, and attaches a terminal receipt.

The core also includes governance decorators, cryptographic human approval, revocation, provider adapters, input normalization, anomaly signals, and legal discovery exports.

03 / CLAIM BOUNDARY

A flight recorder, not a force field

SIGIL makes narrow software claims that a verifier can check. Public keys must be pinned through a trusted channel. A key shipped beside its own receipt provides portability, not identity.

The verifier can check

  • The governing seal bytes match a trusted signature.
  • The receipt signer committed to the disclosed fields.
  • Receipt order and delegation links form a valid chain.
  • The receipt binds to a signed manifest of source files and active keys.
  • Selected fields match their salted Merkle commitments.

Outside the claim

  • Model inference correctness or obedience.
  • Truthfulness of a tool result or retrieved document.
  • Hardware isolation or an uncompromised host.
  • Authoritative wall-clock time, freshness, or current revocation state.
  • Semantic intent preserved across delegation hops.

04 / TRY IT

Run the source

The repository carries the library, command-line tools, receipt contract, verifier, reference MCP wrapper, tests, and security policy. 

git clone https://github.com/mr-gl00m/sigil.git
cd sigil
uv sync --extra dev
uv run sigil --version
uv run pytest -q
uv run sigil demo
Repository Source, setup, tests, and releases Receipt specification Canonical JSON, signatures, chains, and disclosure Security policy Supported version and responsible disclosure Changelog Release history and migration notes

Free and MIT licensed. If SIGIL earns a place in your stack, fund its continued development.