Each release attaches agent-interface-claude-<version>.zip,
agent-interface-openai-<version>.zip and SHA256SUMS. Download all three into
one directory, then run:
sha256sum -c SHA256SUMS
for archive in agent-interface-*.zip; do
gh attestation verify "$archive" --repo hsb3/agent-interface \
--signer-workflow hsb3/agent-interface/.github/workflows/release.yml \
--source-ref refs/heads/main || exit 1
done
The attestation proves which workflow built the archive. It does not prove host support or that the code is safe. The release notes name the tagged source commit.