Give users evidence they can check.

Include a policy with your server. Earn a checks-passing badge for a specific artifact, policy, platform and tested workflow.

Policy included

A policy artifact is available. It does not certify the server or imply tests passed.

Checks passing

A trusted issuer signed allowed and denied checks. The CLI checks signatures, artifact bindings, expiry and a fresh revocation snapshot.

Start with disposable data

The creator kit supplies rules, positive/negative check templates and a README badge. Run a prepared server inside the sandbox with fake credentials. Review permissions before signing; keep the issuer private key outside all server grants.

warden creator init --output ./warden-kit
warden creator keygen --output /private/issuer.key
warden creator check --policy policy.yaml --rules rules.json --artifact /prepared/runtime --manifest checks.json --key /private/issuer.key --output evidence.json -- /prepared/server
warden creator verify --policy policy.yaml --rules rules.json --artifact /prepared/runtime --manifest checks.json --public-key /trusted/issuer.key.pub --revocations /trusted/revocations.json --evidence evidence.json --badge checks-passing.svg -- /prepared/server

Distribute issuer trust and revocation snapshots independently. Changed artifacts, rules, launchers or policies require fresh checks. Evidence expires after seven days; signatures prove issuer provenance, not complete safety.

Inspect signed evidence →Creator and CI guide →