Publish to the registry

Publishing is three commands. The private key never leaves your machine. Install the CLI with npm i -g aisot (or drive the raw API directly, below).

• aisot init generates an ES256 key, registers you as a publisher, and writes aisot.json.
• aisot publish <path> hashes the artifact, builds and signs the record, and POSTs it (Idempotency-Key automatic).
• aisot verify <digest|file> checks a record's signature and log inclusion.

The record profiles

• provenance (ATTESTED): who or what made an asset. Instant, self-serve, rate-limited.
• verification (VERIFIED): the full claims and entailment profile, pinning the judge by hash. Reviewed, because claiming verification is a stronger statement.
• payout: a platform's signed attestation of what it paid a source. The registry attests; it never moves money.

Write authorization

An append requires a Tier-2 token with the matching publish:* scope AND a record signature that verifies against your registered key. Either one alone appends nothing. Register a publisher with POST /v1/publishers and mint a token at https://aisourceoftruth.com/oauth/token.

The schema is a commons

The report JSON Schema is published under CC0 at https://aisourceoftruth.com/spec/schemas. Build against it; the schema and ingest contract are frozen.

In CI

The publish action attests build artifacts on every release: point it at your files and every one gets a signed, idempotent provenance record. The private key never leaves the runner, and a re-run re-publishes nothing (Idempotency-Key is automatic).

```yaml

• uses: aisot/publish@v1

with:

paths: |

dist/*.tar.gz

key-id: ${{ secrets.AISOT_KEY_ID }}

private-jwk: ${{ secrets.AISOT_PRIVATE_JWK }}

client-id: ${{ secrets.AISOT_CLIENT_ID }}

client-secret: ${{ secrets.AISOT_CLIENT_SECRET }}

```

A GitLab template ships beside the action. Keyless signing via CI OIDC identity (zero key management) is the v1.1 roadmap.