Each use case below is a real, unedited Claude Code session in which Claude is given a supply-chain task and runs the real cilock CLI to do it. The recordings are replayed as selectable terminal text (not video), so you can read every command and every result. Where a page says so, TestifySec wrote the prompts and any permission approvals; what Claude and cilock did in response is not edited.

• Rebuild a compromised package — LiteLLM was backdoored on PyPI, so build it yourself from a forked source under eBPF, verify the chain against a signed policy, install it with zero egress, and use it.
• Catch a compromised CI dependency — a force-pushed tag turns a pinned action into a credential harvester; CI/lock's eBPF tracing and secret scanning catch it and a signed policy blocks the release.
• Signed compliance evidence (GRC) — a CIS Ubuntu scan becomes a signed attestation mapped to NIST 800-53 / FedRAMP; a policy blocks the release on high-severity failures. The compliance scanners are compiled in with the rookery builder.
• Release gates — verifying a signed attestation against a Witness policy: one build that passes the gate, and one that the gate blocks.
• Write a policy and prove it: Claude writes a policy for a Go test step from cilock policy guide, then cilock policy prove shows a passing run is admitted and a failing run, a faked command and an empty test suite are refused.
• Triage scanner findings with signed VEX: Claude checks that none of a module's govulncheck findings reach the code, signs an OpenVEX statement for each with cilock attest vex, and shows the policy refusing the release when one statement is missing.
• Ship the binary you built and tested: Claude records a Go build and its tests, chains them with artifactsFrom in a signed policy, and shows a swapped binary and a source edit between build and test are both refused.
• Make a release approval expire: Claude signs a release policy that expires in seven days and shows the same policy with a past expiry refusing the same build with policy expired.
• Block a banned dependency with a signed SBOM: Claude records a CycloneDX SBOM as signed evidence, writes a policy that bans github.com/dgrijalva/jwt-go, shows it blocking the repo, migrates the code and shows the same policy passing.
• Verify a download before you install it: Claude checks a cosign release's Sigstore bundle with cilock verify-bundle against the signer named in Sigstore's docs, then shows a changed byte and a wrong signer are both refused.