create_envelope
Create a signed Ed25519 provenance envelope for a Git commit to record actor, tool, and scope metadata for audit and verification.
Instructions
Create a signed Git commit envelope with Ed25519 provenance metadata.
Use after staging changes and before or after ``git commit`` when you need
commit-time actor/tool proof. Prefer ``sign_action`` for non-Git evidence
(CI steps, IaC, migrations). Do not use for verification — call
``verify_envelope`` or ``verify_pr_range`` instead.
Side effects: may write ``.matrixscroll/envelopes/<sha>.json`` when ``save``
is true. Requires a Git repo and Matrix Scroll identity store. No network.
Returns ``{ok, sha, envelope, path, error?}``.
Parameters:
workspace: Git repo root (defaults to detected repo).
commit_sha: Existing commit to envelope (defaults to staged/next commit).
actor_type: Provenance actor, e.g. agent, human, ci.
tool: Producing tool name, e.g. cursor, claude-code.
agent_scope: Optional bounded scope path/glob for agent commits.
sign: Ed25519-sign the envelope (default True).
save: Persist under .matrixscroll/envelopes (default True).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| save | No | When true (default), persist the envelope under .matrixscroll/envelopes/. | |
| sign | No | When true (default), Ed25519-sign the envelope with the active key store. | |
| tool | No | Producing tool name recorded in provenance, e.g. cursor or claude-code. | |
| workspace | No | Absolute or relative path to the Git repository root. Leave empty to auto-detect from the current working directory. | |
| actor_type | No | Provenance actor label recorded in the envelope, e.g. agent, human, or ci. | |
| commit_sha | No | Existing commit to envelope (full or short SHA). Empty uses the staged commit or HEAD depending on hook context. | |
| agent_scope | No | Optional path or glob limiting what an agent commit claims to touch. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||