Companion to the existing protect-mcp and review-agent-governance plugins
in the governance category. This one is a teaching skill, not a runtime
hook: a cookbook-style walkthrough for explaining, evaluating, or
demonstrating the signed-audit-trails pattern before committing to the
protect-mcp infrastructure.
Contents
────────
- plugin.json, README.md (explains this is a teaching skill, not runtime)
- skills/signed-audit-trails-recipe/SKILL.md (~1600 words) walking through:
1. Hook configuration in .claude/settings.json
2. Cedar policy authoring (four permit/forbid rules)
3. Using Claude Code normally with hooks active
4. Inspecting a produced receipt
5. Verifying the chain with @veritasacta/verify
6. Demonstrating tamper detection live
Plus: three-invariant cryptographic model (JCS + Ed25519 + hash chain),
cross-implementation interop table (4 implementations), CI/CD YAML
snippet, SLSA composition via ResourceDescriptor byproduct, common
pitfalls, references.
Marketplace entry
─────────────────
Added under category: "governance" immediately after protect-mcp. Keywords
emphasize the tutorial/cookbook nature ("tutorial", "skill", "recipe") to
distinguish from the runtime plugins.
Why this is useful alongside the two existing plugins
─────────────────────────────────────────────────────
protect-mcp is runtime. review-agent-governance is runtime (with human-
approval pattern). signed-audit-trails is education. A user evaluating
whether to adopt receipts can invoke the skill to get the concept and a
reproducible demo in-session, then install the runtime plugin if they
decide to proceed. Pairs naturally with /audit-chain and /verify-receipt
slash commands shipped in protect-mcp.
No new dependencies. Same IETF draft + @veritasacta/verify references as
the other governance plugins.
tommylauren