Verify an audit export

For auditors, compliance teams and security reviewers. Planwright records every change to its work, such as an objective approved, claimed, accepted or released, as a hash-chained, signed audit record. An audit export is a file of those records, and the whole file is signed with the workspace's own key. You can check it yourself in a few minutes with standard tools. You don't need a Planwright account, and you don't have to take Planwright's word for it.

1
Get the export
Workspace members download it from the Audit page in Planwright: filter by date, event or actor if you only need part of the history, then export. If you don't have a Planwright account, ask the workspace owner to send you the file. Save it as audit-export.json.
The filters used are recorded inside the file, under filters, so you can see what the export does and doesn't cover.
2
Get the public key from the trust page
Every workspace has a public trust page at planwright.tools/trust/<workspace>, with no login. It shows the workspace's signing public key. Take the key from there, not from the export file: the trust page is the independent source, which is what makes a forged, re-signed file fail the check.
The trust page shows these same commands with the key already filled in, ready to copy.

Run the commands

In the folder holding audit-export.json, run the commands below, replacing the placeholder with the full key. You need jq, xxd and openssl, which come with or install easily on macOS and Linux (on Windows, use WSL).

jq -jcS 'del(.bundleSignature)' audit-export.json > canonical.json
jq -r .bundleSignature audit-export.json | xxd -r -p > sig.der
echo <PUBLIC_KEY_FROM_TRUST_PAGE> | xxd -r -p > pub.der
openssl pkey -pubin -inform DER -in pub.der -out pub.pem
openssl dgst -sha256 -verify pub.pem -signature sig.der canonical.json

4
Read the result
Verified OK means the file is exactly what Planwright exported, and it was signed with this workspace's key. Verification failure means the file was changed after export, or was signed with a different key. Treat a failure as a file you can't rely on, and ask the workspace owner for a fresh export.
An export from a workspace that has no signing key is labelled UNSIGNED in its verificationInstructions field and never verifies.

What a passing check tells you

It proves

The file hasn't changed since Planwright exported it: not one record, field or character.
It was signed with this workspace's key, which is held in AWS KMS and never leaves it.
Every record in it, with who did what and when, is exactly what Planwright's ledger held when the file was exported.

It doesn't prove

It doesn't recompute each record's hash or the links between records inside the file. Planwright checks the chain itself nightly and shows the result on the trust page.
It doesn't show what was left out by the export's filters. Check the filters field.
It doesn't check each record's own signature. The file's verificationInstructions field shows how to check a single record with OpenSSL.

Using it as SOC 2 evidence

The audit chain is designed to map to the 2026 AICPA Trust Services Criteria for AI-generated code, in particular change management (CC8.1) and monitoring (CC7.2): each change records the human who approved it, agents can't approve their own work, and records are append-only, so a correction is a new record that points to the old one. Whether that meets your control objectives is your call as the auditor. The compliance brief walks through the mapping in detail.

← Install as an Agent Skill API Reference →