CAIN-42 CAIN StudioThe attestation
Every verdict is an in-toto Statement v1 wrapped in a DSSE envelope, signed with Ed25519.
| Field | Holds |
|---|---|
subject[0].digest.sha256 | SHA-256 of the exact diff the gate read |
subject[1].digest.gitCommit | the PR head commit (when the caller sends it; the Action does) |
predicateType | https://cainstudio.online/keystone-ci/predicate/v1 |
predicate.verdict, findings, gate | PASS/REVIEW/BLOCK, every finding, engine version, model_in_decision: false |
Since 1.1.0 a verifier also checks the statement is a KEYSTONE CI statement (the same KEYSTONE key signs other products' evidence) and, when you hand it your diff or head commit, that the attestation names exactly that code:
curl -s -X POST https://cainstudio.online/keystone-ci/verify -H 'Content-Type: application/json' \
-d '{"attestation": {...}, "diff": "<the PR diff>", "head_sha": "<head commit>"}'
Sample envelope from the live gate: keystone-ci-sample-attestation.json.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.