Planwright
PricingAudit log
Public Trust Page·No authentication required

Silverback CTO

workspace / silverback-cto · plan / free · since / 4/10/2026

Chain intact

11641 records

All records verified · hashes recompute · signatures present

verified 2026-10-24T03:13:23.868Z

Audit records

11,641

Unique actors

13

First record

4/10/2026

Last record

1d ago

Top event types

objective.lane_changed
2344
objective.commit_linked
1801
objective.created
1242
objective.updated
961
agent_run.started
791

Workspace signing public key

3059301306072a8648ce3d020106082a8648ce3d03010703420004a4d0462463171fbe7a0a9895cd0721fd31a63dc93d66e547f560d6451722949c1da4df0f8284b468242d50d68471ffc587a848d15902dac43e808f626fe0d678

ECDSA P-256 · 91 bytes · used to sign every audit record in this workspace via AWS KMS

Records created before KMS provisioning have placeholder signatures (signature = record hash). All new records are signed with ECDSA_SHA_256 via a dedicated KMS key per workspace.

Verify this chain yourself

The audit chain is append-only, hash-chained via SHA-256, and signed per record. To check it independently, get the signed export and verify its signature against the public key above with standard tools.

1 · Get the signed export

Members of Silverback CTO download it from the Audit page in Planwright. Auditors without an account can ask the workspace owner for the export file.

2 · Verify it with OpenSSL
jq -jcS 'del(.bundleSignature)' audit-export.json > canonical.json
jq -r .bundleSignature audit-export.json | xxd -r -p > sig.der
echo 3059301306072a86… | xxd -r -p > pub.der
openssl pkey -pubin -inform DER -in pub.der -out pub.pem
openssl dgst -sha256 -verify pub.pem -signature sig.der canonical.json

Run in the folder holding the export, saved as audit-export.json. Needs jq, xxd and openssl. Copy includes the full public key above.

Verified OK means the file is exactly what Planwright exported and was signed with this workspace's key. Verification failure means it was changed or signed with a different key. The key comes from this page, not from the file, so a re-signed forgery fails too.

The export is signed with ECDSA P-256 by this workspace's AWS KMS key. The same steps, plus how to check an individual record's signature, are in the file's verificationInstructions field. Exports from a workspace without a signing key are labelled unsigned and won't verify.