How it works · CodeQuill

Overview

What is CodeQuill?

CodeQuill is memory infrastructure for software. It preserves verifiable, immutable evidence of what source code existed at a given point in time, and under whose authority.

Evidence is anchored to EVM blockchains (Ethereum) and stored on IPFS / Filecoin. All evidence is independently verifiable without CodeQuill's servers.

Pipeline

Five primitives, one provenance chain

CodeQuill produces five types of verifiable evidence, each building on the previous. Together they form a complete provenance chain from source to artifact.

Claim a repository

Register your GitHub repository on-chain, establishing your workspace as the authority over that codebase. This creates a verifiable link between your GitHub identity and your Ethereum wallet.

~/your-repo · zsh

$ codequill claim

Publish a snapshot

Create a deterministic cryptographic fingerprint (Merkle root) of your repository's source code at a specific git commit. The snapshot is anchored on-chain and the manifest is stored on IPFS.

~/your-repo · zsh

$ codequill snapshot

$ codequill publish

Create a release

Designate one or more snapshots as a named, versioned release. Releases have a governance lifecycle: they can be accepted, rejected, or revoked. This provides a formal decision record for your software versions.

app.codequill.xyz · web

# Created via the web application

Attest build artifacts

Link your build artifacts (Docker images, npm packages, binaries) to the specific source release that produced them. This creates supply-chain provenance: anyone can verify that an artifact was built from a specific, evidenced source state.

~/your-repo · zsh

$ codequill attest --release v1.0.0 --artifact ./dist/app.tar.gz

Preserve source code

Create an encrypted, zero-custody archive of your source code tied to a published snapshot. The archive is stored on IPFS / Filecoin and can only be decrypted by workspace members using their passkey-derived encryption keys. CodeQuill never possesses the decryption keys.

~/your-repo · zsh

$ codequill preserve

Verification

Trust nothing, verify everything

All evidence produced by CodeQuill is independently verifiable. Anyone can:

Query the smart contracts directly on Ethereum to verify claims, snapshots, releases, and attestations.
Retrieve manifests from IPFS using the content identifier (CID) stored on-chain.
Recompute the Merkle root from source files to verify snapshot integrity.
Validate Merkle proofs-of-inclusion to confirm a specific file was part of a snapshot.

No trust in CodeQuill's servers is required. The evidence layer is designed to outlive the platform.