Provenance receipts

Written by anyone. Verified by WP HealthKit.

The WordPress ecosystem is being flooded with AI-written plugins, and nobody can tell verified code from unverified code. Every WP HealthKit audit mints a provenance receipt — a signed, public attestation that a specific artifact, identified by its SHA-256 hash, passed the full 62-layer audit. Not "we looked at it" — a receipt anyone can check.

How it works

STEP / 01

Issue

Every completed audit mints a receipt automatically: artifact hash, grade, layers run, date — signed with HMAC-SHA256. Nothing for the developer to do.

STEP / 02

Embed the badge in your plugin readme or paste the receipt link anywhere. Buyers, hosts, and reviewers get an instant verified answer.

STEP / 03

Verify

Anyone checks the receipt page, the JSON API, or recomputes the artifact hash locally. No account, no cost, no trust in us required.

What a receipt attests

{
  "artifactSha256": "3f9a1c…",   // the exact ZIP we audited
  "plugin":  { "name": "…", "slug": "…", "version": "…" },
  "grade":   "A",                 // report-card grade (A–D)
  "layersRun": 62,                // verification layers that ran
  "scoreOverall": 96,
  "auditId": "…",                 // link to the full report
  "issuedAt": "2026-07-27T…",
  "signature": "hmac-sha256…"    // forge-proof without our secret
}

The signature is computed over the payload with HMAC-SHA256, so anyone can confirm a receipt is genuine through our public verify page or API — but nobody can forge one. Re-audits supersede older receipts, and the verify page always tells the truth.

For developers

Verify your artifact locally

# 1. Run an audit (free, no account needed for the first one)
#    https://wphealthkit.com/upload

# 2. Confirm your ZIP is the one we audited
shasum -a 256 your-plugin.zip
# compare with artifactSha256 on the receipt

# 3. Machine-check the receipt
curl https://wphealthkit.com/api/v1/receipts/<id>/verify

Receipts are free with every audit — including the free tier. Embed the badge in your readme so buyers see proof before they install.

Audit your plugin free Fix Plan

Why a provenance standard

AI code is everywhere

Buyers and reviewers can't tell human-written from AI-written from hybrid. The answer isn't to ban it — it's to verify it. A receipt says: whatever wrote this, it passed.

Trust shouldn't require an account

Verification is public and offline-checkable. If WP HealthKit vanished tomorrow, the hash + signature still prove what was attested, when.

The truth over time

Re-audits supersede old receipts. A receipt isn't a trophy — it's a living attestation that degrades gracefully when the plugin changes.