Evidence bundle

A portable, signed proof of what happened: the in-toto DSSE Statement v1 envelope, the predicate body, the manifest of bundled files, and an ed25519 signature over a canonicalised hash. Verification runs in your browser via SubtleCrypto.

in-toto DSSE Statement v1

https://in-toto.io/Statement/v1

signed envelope

Subject

run:01KR5SQZPDGTKE3MDP3ZRX8WP1

sha256: 1215e8dd557a386b96a6517f4599560e…

Predicate type

https://novafabric.dev/schemas/run-capsule/v0.1.0

Signature

keyid: demo-key-2026
alg: ed25519
sig (b64): mehFh2YPsMVGv2GEp/CkPS+PeIHdEWH9/8f76DBYSTuuUPCT6WEMovN9jQivaYeSCL8RSjHQlatnb0Vgms9/Bw==
message hash: sha256:aa6b5d6559b287a48899d4464edee36c1979813dea9109a6b65b601c15fa7361

Bundle contents

10 files

▸capsule/capsule.yamlba95ab536bdb…1,820B
▸capsule/trace.jsonla8894b7ca2f8…312B
▸capsule/model-calls.jsonl4ea4bbb82a32…1,240B
▸capsule/tool-calls.jsonl679c2e2da9c5…880B
▸capsule/env.lock9cd67aa93a94…4,612B
▸capsule/redaction-proof.jsondd999ecfc888…1,816B
▸lineage.jsonl9ea5107177d4…2,104B
▸predicate.json9f477be98c54…480B
▸dsse-statement.json39a7d55cf5d5…612B
▸schemas/run-capsule.schema.jsonvendored…8,420B

manifest_hash:8171166756424187f680c1ef0c788275bcaa7aac1053d9103c44b4fbfc6b105c

On your machine

nova export-evidence <run-id>
# verify with the standard openssl/cosign tooling against your deployment key
nova verify-evidence bundle.zip