ackt
PROOF A PERSON WAS PRESENT

Someone has to actually read the diff.

An agent wrote the code. You opened the pull request. ackt is where you say, with a passkey gesture, that you read it — recorded against this exact commit, under your name, where nobody can later disclaim it.

Not proof of correctness. Proof a person was present, and put their name on it.

Add the workflow file Read the spec

An agent holding your keys can fake every review signal but one.

Your GitHub token, SSH keys, and GPG keys are files on disk. Anything acting under your credentials can read them — and produce every signal your process treats as “a human reviewed this.”

PR approvalsforgeable “/reviewed” comments, checked checkboxesforgeable GPG-signed commitsforgeable — the key is a file A passkey ceremony with user verificationrequires a finger, a face, or a PIN

How it works

Read

ackt comments on the pull request with a link. Someone opens it and actually reads the diff.

Attest

They confirm with a passkey: Touch ID, Windows Hello, a security key. A biometric or PIN gesture, not just a click.

Record

The claim goes on record against that exact commit, and the ackt / human-review check flips green.

Install: one workflow file

No app to install, no permissions to grant beyond what any other Action already asks for. Find it on the GitHub Marketplace, or copy the YAML below straight in.

GitHub Marketplace View the Action 
name: ackt
on:
  pull_request:
    types: [opened, reopened, synchronize]
  issue_comment:
    types: [created, edited]

permissions:
  contents: read
  id-token: write
  statuses: write
  pull-requests: write
  issues: write

jobs:
  ackt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # required — the Action needs real history to check ancestry, even though it fetches its own head SHA
      - uses: jrschumacher/ackt-action@v1
        with:
          service: https://ackt.dev
          fail-on-unattested: "false"

What this isn’t

ackt is not a security boundary. Someone determined to lie can still attest a diff they didn’t read, or ask someone else to press the button for them. What resists that is a WebAuthn assertion bound to their GitHub login and a real biometric or PIN gesture, not encryption or access control.

It’s not a quality signal either. Attested doesn’t mean tested, reviewed by a second person, or free of bugs. It means one specific human looked at one specific commit and put a name on it.

FOR TEAMS AND ENTERPRISES

Organizational policy over which authenticators qualify — hardware FIDO keys included. Analytics on attestation coverage across your organization. Real-time results, not a workflow run. Talk to us if your compliance program needs any of it.

In development. The free path above stays exactly as it is.

Talk to us

Already using ackt? Enroll a passkey once, then attest from any pull request link.

Enroll a passkey