TrustSignal — Repo Hardening + Product Signal Update

TrustSignal — Repo Hardening + Product Signal Update

We’ve been tightening the TrustSignal repository to reflect where the product actually is: moving from prototype → infrastructure layer.

What changed

• Shipped v0.7.0 with real zero-knowledge proof generation + verification (replacing mock flows)
• Hardened revocation paths and verification lifecycle handling
• Cleaned up the public repo surface (README, docs, evaluator flow)

Why this matters

TrustSignal is not another compliance tool.

It’s an evidence integrity layer that sits after collection — where most real risk actually shows up:

• tampered artifacts
• broken provenance chains
• unverifiable evidence at audit time

We don’t replace systems like Vanta/Drata.

We make their outputs defensible later.

What the repo now demonstrates

• Signed verification receipts
• Deterministic verification lifecycle
• Later verification (not just point-in-time checks)
• Clear integration boundary with existing workflows

Near-term execution

• Enforcing signed commits on the default branch (aligning infra with product thesis)
• Closing remaining compliance evidence gaps (SOC2 / Vanta readiness)
• Reducing dependency noise and tightening repo governance

Bottom line

The goal is simple:

If an artifact is challenged later, you can prove it hasn’t changed.

That’s the layer TrustSignal is building.

If you're thinking about audit defensibility, trust infrastructure, or post-ingestion risk, happy to talk.