Signed context capsules
Signed context capsules for AI agents.
The files that steer an AI agent — instructions, personas, skills, memory — are plain text with no provenance. ALTWEB compiles markdown into a self-contained, signed capsule you can hand to anyone, and gives your agent one rule: verify before you inject.
01 · The problem
Context has no provenance.
Plain text steers the agent
Instructions, personas, skills, memory files — they are injected into the model as-is. The agent treats whatever is in the file as ground truth.
Anyone who can write it can poison it
A rogue process, a compromised sync, a bad merge, another tool on the same machine — one silent edit and the agent runs on someone else’s instructions.
Tampering leaves no mark
Plain markdown carries no author and no integrity check. There is nothing to verify, so nothing gets verified — the edit simply wins.
02 · The capsule
Markdown in, sealed artifact out.
A capsule is your markdown compiled into a single .altweb.html file or URL:
content compressed with deflate, optionally encrypted with AES-256-GCM, optionally signed
with ECDSA P-256. It opens in any browser, verifies offline, and needs no server.
flowchart LR MD["markdown"] --> C["compress<br/>(deflate)"] C --> E["encrypt?<br/>(AES-256-GCM)"] E --> S["sign?<br/>(ECDSA P-256)"] S --> A["self-contained artifact<br/>.altweb.html / URL hash"]
The file is the payload
Content lives in the URL hash or in the file itself. No hosting requirement, no backend, nothing to take down.
A passphrase is a keypair
Your signing identity derives deterministically from a passphrase. The fingerprint identifies the signer; only the public half is ever stored.
Verification needs nobody
The signature travels inside the capsule. Anyone can check who signed it and that not one byte changed — with no server involved.
03 · Verify before inject
The loader is the gatekeeper.
The altweb-context MCP server sits between your capsules and your agent. It
returns content only when the capsule is signed, the signature verifies, and the signer’s
public key is in your local trust file. Everything else is refused, at load time, with an
explicit reason — and refusal is the default: an empty trust file rejects everything,
signed or not.
Signed + verified + trusted
The markdown is returned to the agent, prefixed with the verified signer’s name and fingerprint — provenance travels with the content.
Everything else, with a reason
UNSIGNED — no signature at all. INVALID_SIGNATURE — bytes changed since signing. UNTRUSTED_KEY — valid signature, but the fingerprint is not in your trust file.
04 · Write and ship
Two ways to make a capsule.
altweb compile –sign
One command from markdown to signed artifact: compile, decode, verify, keygen. Scriptable end to end — exit codes make verification a build step.
Write visually, export sealed
A Notion-style editor built on Novel: write in a WYSIWYG surface, export a capsule as a downloadable file, a URL, or a QR code.
05 · Get started
Five minutes to a verified capsule.
Generate an identity, sign a file, verify it, and wire the loader into your agent — the quickstart walks the whole loop. Or inspect a real signed capsule we publish here, or make your own right now in the visual editor.