CodeQuill — ETHGlobal Spotlight ⭐️

Memory infrastructure for software.

Source code is the most reproduced asset in the world, and the least preserved. Repositories vanish. Releases get repackaged. Build artifacts have no verifiable origin.

CodeQuill is the evidence layer. Cryptographic, on-chain, independently-verifiable records of what source code existed, when, and under whose authority without taking custody of the code itself.

Live on Base today at https://app.codequill.xyz.

What it does

CodeQuill turns repository state into evidence.

• codequill snapshot produces a deterministic Merkle root over your source tree at a specific git commit.
• codequill publish anchors that root on-chain through your workspace’s authority wallet.
• codequill attest binds a build artifact to a published release giving downstream consumers a cryptographic chain from npm install → release → snapshot → commit → source files.
• codequill preserve archives the source itself, end-to-end encrypted with a passkey-derived key, on IPFS. The bytes survive the company or any GitHub corruption.

Authority is configured in the web app. Evidence is produced locally on developer machines or CI runners. No source code ever transits CodeQuill servers in plaintext.

What’s possible

• 🔐 Tamper-evident open-source supply chains. Ship a package, attest the artifact, let downstream verify lineage without trusting a registry.
• 🏛 DAO-grant accountability. Grantees publish snapshots on a public timeline; the DAO accepts or rejects releases on-chain.
• 🕵 Forensic incident response. When a backdoor lands, prove exactly which commit introduced it and which release shipped it.
• 📜 Sovereign release records. Maintainers can prove authorship long after a fork, a rebrand, or a company shutdown.
• 🔏 Zero-knowledge preservation. Archive private code with a passkey : only the holder can decrypt; the chain proves it existed.
• 🤖 AI-agent code with receipts. When an agent commits and publishes, the on-chain trail shows exactly which authority signed off.