Pluck Studio / Bureau

TRIPWIRE / me

Per-machine outbound LLM timeline. The dossier lives on YOUR machine — Pluck Bureau never sees the bodies. This page is a placeholder that explains how to read your local dossier; Phase 2.5 wires the Kite Event Log so opted-in operators can publish their dossier hash here.

Where to find your dossier

cat ./.tripwire/me-dossier.json

Replace the path with whatever you passed to pluck bureau tripwire install --out. The dossier is a JSON file with a list of TimelineDot entries — each one a single intercepted (request, response) pair, classified against your policy.

Inspect a captured cassette

cosign verify-attestation \ --key public.pem \ --type https://pluck.run/AgentRun/v1 \ ./.tripwire/cassettes/<envelopeHash>.json

Same verification surface as DRAGNET — TRIPWIRE cassettes follow the in-toto Statement v1 + DSSE wrapping convention every Pluck verb-module emits.

What stays local

  • Request bodies — never leave your disk by default.
  • Response bodies — never leave your disk by default.
  • Cassette envelopes — never leave your disk by default.

Pass --notarize to publish non-green cassettes to the public Sigstore Rekor log. That's the operator's opt-in, never the default.