We sign every export our AI app builder produces. Here's how it works
I'm building SPOE, an AI app builder. Every tool in this space says "you own your code". I wanted to be able to prove it, so every export SPOE produces is signed. This is how that works, in enough detail that you can poke holes in it. When an AI writes your app, two questions follow the code around. Is this exactly what I was shown? And does it quietly depend on the tool that made it? A ZIP answers neither. Three files ride along with every project: PROVENANCE.json, PROVENANCE.sig and verify-pr…