Stage342 extends Stage341 by adding external anchoring support for the signed verification session manifest.
Stage341 created:
session_manifest.json
↓
GPG signature
↓
Ed25519 witness signature
↓
Sigstore bundle
↓
independent verification
Stage342 adds:
checkpoint witness
↓
GitHub Actions anchor support
↓
OpenTimestamps support
↓
external_anchor_receipt.json
What Stage342 Adds
Checkpoint witness signature
Checkpoint witness public key
GitHub Actions anchor workflow
GitHub Actions anchor intent
OpenTimestamps support when ots is available
External anchor receipt
Public Files
docs/anchors/external_anchor_receipt.json
docs/anchors/github_actions_anchor_intent.json
docs/checkpoints/checkpoint_witness.json
docs/checkpoints/stage342_checkpoint_witness.pub
docs/checkpoints/checkpoint_allowed_signers
docs/checkpoints/session_manifest.checkpoint.sig
docs/session/session_manifest.json.ots if OTS succeeds
.github/workflows/stage342-external-anchor.yml
Verification
Checkpoint witness:
ssh-keygen -Y verify \
-f docs/checkpoints/checkpoint_allowed_signers \
-I stage342-checkpoint-witness \
-n stage342-checkpoint-witness \
-s docs/checkpoints/session_manifest.checkpoint.sig \
< docs/session/session_manifest.json
OpenTimestamps, if .ots exists:
ots verify docs/session/session_manifest.json.ots
GitHub Actions anchor:
gh run list --workflow "Stage342 External Anchor"
After a run completes, download:
gh run download <RUN_ID> \
-n stage342-external-anchor-artifacts \
-D downloaded_stage342_external_anchor
Safety Boundary
Stage342 does not publish:
private keys
attack code
dangerous prompts
exploit payloads
bypass procedures
automated attack logic
Meaning
Stage342 moves the signed verification session manifest from local signed evidence toward externally anchored evidence.
This recovers the remaining Stage254 direction:
session manifest
↓
witness
↓
GitHub Actions anchor
↓
OpenTimestamps
↓
external verification
License
MIT License
Copyright (c) 2025 Motohiro Suzuki