writ record

Use writ record for record integrity operations. Use writ review to read a run in the terminal or a local browser.

Export a signed record

writ record export bug-fixer --out artifacts/bug-fixer.writ-record.json

The bundle contains the run metadata, redacted entries, hash chain, and latest signed checkpoint. The command prints the public trust-key path. Share the public key through a separate trusted channel.

The private record signing key remains beside the project record under ~/.writ/projects/<project-id>/. Do not share it.

Verify on another machine

Copy the bundle and public key to a machine that does not use the source database. Then run:

writ record verify artifacts/bug-fixer.writ-record.json \
  --trust keys/project-record-signing-key.public.json

Verification checks:

• the bundle type and version;
• every entry hash and previous-entry link;
• the complete checkpoint root;
• the Ed25519 checkpoint signature;
• the trusted signer key ID.

A changed, removed, inserted, or reordered entry fails verification.

Add an independent witness

An independent witness signs the checkpoint identity and the time it observed it. It does not receive record entries or tool arguments.

writ record witness artifacts/bug-fixer.writ-record.json \
  --url https://witness.example.com/v1/witness \
  --witness-trust keys/witness.public.json \
  --out artifacts/bug-fixer-witnessed.writ-record.json

Verify both signatures:

writ record verify artifacts/bug-fixer-witnessed.writ-record.json \
  --trust keys/project-record-signing-key.public.json \
  --witness-trust keys/witness.public.json

Read Run a record witness to operate the witness service.

Storage and redaction

Writ stores each project record at ~/.writ/projects/<project-id>/record.db. Entry rows are append-only. Before storage, Writ replaces common secret fields, bearer tokens, secret assignments, and private keys with [REDACTED]. A signed organization policy can add exact JSON Pointer redaction rules.

Normal native tool-call entries store normalized arguments and a digest of exact provider arguments. Exact provider arguments stay transient unless Writ creates an explicit approval request. The approval request can store them after redaction.

Redaction reduces accidental disclosure. It does not make every possible value safe to share. Review an exported bundle before release.