Ecosystem adapters
Public implementation notes for fitting AIIR into attestation, provenance, and policy surfaces that already exist.
The posture
AIIR is not a replacement for in-toto, GUAC, Sigstore, SLSA, or policy engines. The useful posture is narrower: AIIR becomes one more receipt-bearing surface inside ecosystems that already understand statements, attestations, provenance graphs, and policy checks.
The storyline
1. Emit the receipt
AIIR runs at the source boundary and emits a deterministic receipt for declared AI involvement in a change.
2. Carry it through
The surrounding system treats that receipt as one more statement, graph input, or policy input instead of replacing its own model.
3. Query or enforce it
The host ecosystem keeps answering its own questions: which artifacts carry evidence, which dependencies inherit it, and which policies require it.
Canonical public references: spec, predicate reference, browser verifier, local demo, and the public repo.
Core notes
These are the first public artifacts behind the outreach sequence.
Witness attestor
A narrow attestor shape that emits an AIIR receipt as one more artifact in a Witness-style pipeline.
GUAC ingestor
A graph-ingestion sketch for making AIIR receipts queryable as source provenance metadata.
In-toto policy input
A lightweight integration shape that carries AIIR in an in-toto envelope and checks a verified receipt when AI involvement is declared.
Follow-on notes
These pages extend the same storyline into policy and release ecosystems without changing AIIR's local-first core.
gittuf policy
A policy-hook shape for requiring a valid AIIR receipt on protected paths when AI use is declared.
Sigstore bundle
A packaging note for treating AIIR receipts as signed evidence alongside Sigstore bundle workflows.
Source attestation attachment
An example shape for attaching declared AI involvement to a source attestation flow without redefining the surrounding attestation model.
How to use these pages
- Start with the page that matches the target project's extension surface.
- Use the note as the public artifact in outreach, then move discussion into an issue or PR if there is interest.
- Keep AIIR's local workflow intact: the adapter is additive, not a new product tier.