The objects

A verification reads up to four things: a private bundle of evidence, the public registry entry that commits to it, a trust registry that authorizes the key that signed the entry, and a trust root that authenticates the trust registry. The diagram shows how they refer to each other; the list under it names the part of the specification that defines each one.

The entry commits to the bundle; the trust registry authorizes the key that signed the entry; the trust root you pin signs the trust registry. The verifier reads the bundle, and whichever of the other three you supply, on your machine and writes a report.

The bundle

The private side: the evidence files, and three objects that describe them. manifest.json declares by digest every file of the bundle except itself, the envelope, the receipt and their digest sidecars, p1.json carries the input hash, a digest of the canonical input, and envelope_env1.json links the bundle’s identity to the digests of the manifest and of p1.json. Their closed field contracts, and the rules for reading a bundle from a ZIP archive, are part 5, bundle objects. The digests are computed as part 4 specifies. A bundle may also carry a verification receipt, whose schema is verification_receipt.

The registry entry

The public side: a small record that commits to digests of the bundle and is signed by the issuer. It carries no evidence, as part 2 requires. Its fields are part 8, registry entry and its schema; the bytes the issuer signs are part 6. How a verifier compares an entry with a bundle, the link check, is part 9.

The trust registry

A public record of which issuer keys may sign entries, for which asset types and workflows, and when. The authorization check that reads it, and what it may carry, are part 10; its fields are its schema.

The trust root

A document you obtain out of band, from a party you trust, naming the keys entitled to sign a trust registry. It is the only path from REVIEW to PASS in the authorization check: part 11, trust-root authentication.

The report

What a run writes: the status, the verdict, the exit code, the checks requested and established, and the reasons. Part 15, the report contract, defines it; the reason codes are on their own page.

The other object families

The protocol also defines a verification summary, a coverage summary, a change summary and a lineage summary. Section 7 of the introduction describes each family, and the schemas give their fields.