Mantyl is built with itself. Every release below was verified by its own passport before it shipped, and several of the fixes came from findings the tool surfaced about its own repository.
13 Sep 2026
One command, mantyl export, maps the passport into the documents procurement, legal and supply-chain reviews ask for. The AI provenance record supports EU AI Act transparency posture with evidence rather than declarations: how much of the build the agent-session trail actually evidences, which claims were contradicted, what a human confirmed, and what was independently executed, with every truth status defined in place and a limitations section because an honest document names its own edges. The CycloneDX 1.6 AIBOM makes the same trail readable by standard SBOM tooling, down to a serial number derived from the passport digest so even the identifier is reproducible. And the procurement answer sheet fills in the questions security reviews actually ask, each answer traceable to the passport and closing on the one-command independent recheck any reviewer can run. All three are deterministic, generated locally, and free in the CLI. None of them is a conformity assessment, and each one says so itself, which is precisely what makes them worth attaching.
13 Sep 2026
Until today a Python repository got scanned and its agent history read, but the strongest tier of evidence stayed empty: no checks executed. Now the verifier plans a Python stack the same way it plans Node: dependencies install from your uv, poetry or pipenv lock, your requirements files, or an installable pyproject, and pytest, ruff and mypy run in the sandbox when your project declares them. Declared is the operating word: Mantyl never runs a tool your project did not ask for, a configured-but-never-installed linter is surfaced instead of papered over, and every selection or skip records its reason in the plan. A repository with both stacks gets both, each in its own sandbox image, and mantyl receive reproduces each stack exactly as it was recorded. Dogfooding the new verifier also caught two latent defects that are fixed in this release: on Windows the sandbox copy-in marked every file executable and lint reported findings we had manufactured, and a fresh project living inside a larger repository before its first commit produced an empty file manifest that made every receive falsely diverge. Python support is beta; the collector also now reads os.environ and os.getenv references, so undocumented environment variables surface for Python exactly as they always have for Node.
4 Sep 2026
One workflow step now runs the whole evidence pipeline on every push: mantyl ci executes the checks in the runner's Docker, generates the passport, writes the verdict into the Checks area, and fails the job when checks fail, which is the point. At handover points the passport can be sealed as an in-toto attestation in a DSSE envelope, the same shapes GitHub's own artifact attestations use: sign with your own key pair via mantyl attest, or keylessly through Sigstore and GitHub's attestation store on public repositories, and your recipient binds the envelope to the exact passport in hand with mantyl receive. Verification policies became public documents at /policies, served as canonical bytes whose hash equals their advertised digest, so what a signature attests is something you can fetch and hold us to. The delivery console issues CI pairing tokens that link workflow runs to your account (identity only, never payment), README badges now date their evidence past sixty days so stale proof looks stale, and a Claude Code plugin runs the passport loop at the end of a build session. The action installs from the public repository; everything in it was proven against the seeded fixture on real runners before shipping.
2 Sep 2026
The size ladder is retired. Solo, Standard and Large asked every buyer to size their own repository at the exact moment their card was out, and the top tier promised uploads the platform could not accept: our own repository proved it by failing its own checkout this morning. Now there is one price. A verification credit is £29, covers projects up to 10,000 tracked files and a 4 MB compressed upload, and the CLI states your file count and bundle size before anything uploads, so a limit is something you hear about before paying, never after. Everything else stands: refundable until the run executes, an infrastructure failure never consumes the credit, and a run that completes with failed checks includes one free re-run within 14 days. Anyone who already bought under the old prices keeps exactly what they paid for. Bigger builds are coming; if yours is over the limit, the contact page moves it up the list.
2 Sep 2026
mantyl accept is the recipient's final command: it runs the full independent recheck first (a diverged delivery refuses acceptance outright), lists every open finding by id, asks for acknowledgement, and records a detached acceptance bound to the exact passport digest. What was accepted and what was known at acceptance, both on record. Around it, a release of small truths: generate gained a real --no-llm flag, a failing Cursor or Codex adapter now warns loudly instead of silently producing a passport with no agent history, the verified watcher stops politely after an hour instead of polling forever, and the passport reports render the acceptance record and lose their last em dashes. Under the hood the release gates promised in the implementation plan exist and run in CI: byte-identical passports across runs, and a planted credential that provably reaches no artefact. The schemas the docs always promised are also live at /schemas/passport-v1.json and /schemas/config-v1.json, generated from the same source the CLI validates with.
1 Sep 2026
The complete CLI is now public at github.com/jopli11/mantyl-cli under MIT: every package that runs on your machine, including the redaction engine, the sandbox and the session-store adapters, with the full test suite and CI. A tool that reads your private agent transcripts should be auditable, so now it is. Hosted passports gained an embeddable badge: every passport page offers a markdown snippet that renders the passport's live status in a README and links back to the proof, with signal yellow strictly reserved for a signed verification. And three new guides document where Claude Code, Cursor and the Codex CLI actually store session history, written against the adapter source because almost nobody else documents it.
29 Aug 2026
Seven guides on handing over AI-built software are live at /guides: the AI code handover guide, the handover checklist with a free template, vibe code audits, verifying a delivery you paid for, what to do before hiring a rescue developer, the agency delivery standard, and a plain definition of the project passport. Under the hood the site now serves llms.txt and markdown mirrors of every docs page for coding agents, every page carries its own share metadata, the footer reaches every page, and search engines get an honest sitemap.
28 Aug 2026
Mantyl Verified now costs one credit per project, bought at a checkout the CLI opens for you (£19 to £49 by project size at the time, refundable until the run executes; simplified to one £29 price on 2 Sep). The verification worker runs serverlessly on ephemeral CI runners, woken the moment a payment lands, and the first paid verification in history was, fittingly, Mantyl verifying its own repository: payment through a 3D Secure challenge, five checks independently reproduced, signature signed, mark rendered. The homepage now points at that passport. Signed-in users get a delivery console at /dashboard collecting their verified runs, every CLI success block now prints the next command, and the terms and privacy pages state the paid reality plainly. The self-verification along the way caught lint errors our own CI missed, so CI checks more now too.
18 Aug 2026
The verification worker is live in beta: mantyl verified uploads a consented bundle of tracked files, the worker proves the source matches the passport's manifest, re-executes every recorded check in an isolated sandbox, and signs an Ed25519 accreditation binding the passport digest and commit. Hosted passports re-verify the signature on every render before showing the mark. Accounts and the account page arrived alongside, the site gained terms and privacy pages, and the first accreditation ever issued was, fittingly, for Mantyl's own repository. Free while in alpha.
18 Aug 2026
Mantyl now reads Cursor chat history (on Node 22.13 or newer) and OpenAI Codex CLI sessions alongside Claude Code, with the same fail-closed redaction and the same claims and decisions extraction. This release also carries every fix from the first outside test group: decision extraction rejects conversational noise, duplicate claims collapse, platform env vars stop demanding documentation, and passports open with verification instead of the environment table.
24 Jul 2026
The CLI is publicly installable with npm install -g mantyl, a single self-contained package with one dependency. mantyl publish hosts an approved passport at a shareable link derived from its digest, free during alpha, with the server independently rechecking schema and digest before hosting anything. Hosted passports are live in production. The site gained real documentation and this changelog.
23 Jul 2026
Passports now carry the decision log: choices recovered from agent history, with the creator's own recorded words marked as creator confirmed. The whole loop passes on Mantyl's own repository: five sandbox checks pass, the passport generates, and receive independently reproduces every check with no divergence.
23 Jul 2026
Verification runs in one persistent container per project, with network connected for install and then cut. Running Mantyl on itself caught four sandbox defects and one real repository defect: the site fetched fonts at build time, which would have broken any recipient building offline. The fonts are now vendored.
22 Jul 2026
Optional analysis writes an architecture narrative and risk list from redacted evidence. Everything it produces is permanently marked as inference, schema validated locally, and the pipeline stays complete without it.
21 Jul 2026
Scan, verify, generate and receive, end to end. Deterministic scanning with fail-closed secret redaction, Docker sandbox verification, the eight-status truth model, contradiction detection, content-addressed integrity digests and the recipient's independent verdict.