Merge pull request #119 from AymenSegni/add-shipmoor

Add Shipmoor to Project Integrations

Author: JustinCappos

README.md

@@ -32,6 +32,7 @@ This section lists software systems, services, or platforms that integrate with
 | Jenkins          |<img src="img/Integrations_logo/Jenkins_logo.png" width="50" height="50">| The in-toto team maintains a plugin for Jenkins that can be used to generate in-toto metadata pertaining to a particular build or "job". |
 | JFrog          |<img src="img/Integrations_logo/JFrog_logo.png" width="50" height="50">| JFrog Artifact ensures the integrity of evidence predicates and payloads using in-toto |
 | rebuilderd       || Rebuilderd is a build system project part of Reproducible Builds. When the result of a rebuild is positive, i.e., the build process is found to be reproducible, rebuilderd generates an in-toto link recording this result. |
+| [Shipmoor](shipmoor/README.md) || Shipmoor is a local, vendor-neutral verification layer for AI-agent-written code. Its Claim Check feature wraps build, test, scan, and review evidence in in-toto attestations and ships the verdict as a SLSA-shaped Verification Summary Attestation (VSA) with a self-digest, checking reruns byte-for-byte rather than trusting the exit code. |
 | Sigstore         |<img src="img/Integrations_logo/Sistore_logo.png" width="50" height="50">| In-toto and Sigstore are complementary in their efforts, and Sigstore integrates in-toto in a number of ways. Sigstore's keyless signing can be used to sign in-toto metadata, as demonstrated by Cosign's SLSA Provenance generation. |
 | Tekton Chains    | <img src="img/Integrations_logo/Tekton_logo.png" width="50" height="50">| Tekton Chains is a component for Tekton that adds software supply chain security. Chains observes all "TaskRuns" or jobs that are executed, and generates an in-toto attestation. |
 | TestifySec       |<img src="img/Integrations_logo/Testifysec_logo.svg" width="50" height="50">| TestifySec is a software supply chain security company that has created two open source projects that leverage in-toto. Witness and Archivista. |

shipmoor/README.md

@@ -0,0 +1,7 @@
+# Shipmoor
+
+[Shipmoor](https://shipmoor.dev) is a local, vendor-neutral verification layer for AI-agent-written code. Its [Claim Check](https://shipmoor.dev/claim-check) feature freezes a change's stated intent into an acceptance set of atomic, checkable obligations, then binds each one to real evidence: the build, the test suite, deterministic scans, and an advisory code review.
+
+Every piece of that evidence is wrapped in an [in-toto attestation](https://github.com/in-toto/attestation). The resulting verdict (`READY`, `READY WITH GAPS`, `BLOCKED`, or `INCONCLUSIVE`) ships as a SLSA-shaped Verification Summary Attestation (VSA) with a self-digest. Rather than trusting a rerun's word for it, Shipmoor checks whether two runs match byte-for-byte.
+
+The whole loop runs locally: no model is hosted or called by Shipmoor, and no source code is uploaded. See [how Claim Check works](https://docs.shipmoor.dev/docs/claim-check/overview) for the full design, including the [bring-your-own-judge model](https://docs.shipmoor.dev/docs/claim-check/byo-judge) used for the obligations a deterministic check can't yet reach.