Witness

Every release you ship carries fixes that can silently regress. Witness generates a cryptographically signed manifest that maps each documented fix to a file and a marker substring, then tracks how that population evolves across commits in a temporal JSONL log. When something breaks again, you can pinpoint the exact commit that reintroduced it instead of guessing. It's built around Ed25519 signatures derived from your git commit, so verification works without storing private keys. Ruflo itself uses this in CI to gate publishes. You can drop the toolkit into any project, register your fixes in a JSON file, and wire regen into your release pipeline. The history queries are the real payoff: you get a bisectable timeline of what regressed when.