Recipes, ready to hand over.
Each is a real build, distilled: principles, contracts and scars an AI agent germinates back into the capability — on its own stack, in a repository that has never seen yours. New to the idea? What a recipe is →
Every recipe here is sealed — its bytes hash (sha256) to a value committed in the public registry — and gate-passed, re-checked on every push. Verified in CI ↗
Trust you can recompute — and honesty about the rest.
Three claims on every recipe are mechanical and public — each one you can recompute yourself. What isn't real yet gets no badge: a decorative trust mark is worse than none.
Each recipe's exact bytes hash (SHA-256) to a fingerprint committed in the public registry. Open any recipe and click the seal — your browser refetches the source and the registry from GitHub and recomputes the hash. Nothing to trust from this site.
sporo lint checks every recipe against the genre — its summary and eleven gated sections in order, neutrality (no leaked paths or product names), and earned scars — on every push. The green run ↗ is the proof.
Each published recipe's export bytes are Sigstore-signed to this repo's pipeline on merge — keyless OIDC, no key to leak. Hold the file, prove its origin offline: gh attestation verify <recipe>.md -R ydnikolaev/sporo. One byte changes and verify fails. Provenance + integrity, not a safety scan.
No "scanned for prompt injection" mark — that needs a real content scan we haven't built. When it exists it'll be earned, not decorative. Attestation proves a recipe's origin, not that its prose is safe: a recipe is still text an agent reads — audit it before you run it.