An evidence bundle manifest names the sealed export, tenant scope, retained artifacts, Merkle root, record links, and integrity anchors. Use it when an evidence-room export moves between KLA and an offline verifier.
Bundle specification · evidence-room-bundle-v1 · manifest format 1.0
01
The JSON Schema and synthetic files are served from immutable v1 artifact URLs. The production bundle keeps bundle.json and manifest.json as separate files.
/ai-agent-evidence-bundle-manifest/v1/schema.jsonDownload Bundle summary exampleThe bundle.json top-level seal summary for the valid synthetic export./ai-agent-evidence-bundle-manifest/v1/examples/bundle-json-synthetic.jsonDownload Valid manifest exampleA populated manifest linked to the audit execution record example./ai-agent-evidence-bundle-manifest/v1/examples/bundle-manifest-synthetic.jsonDownload Tampered manifest exampleOne artifact digest changed while the sealed digest and Merkle root remain stale./ai-agent-evidence-bundle-manifest/v1/examples/bundle-manifest-synthetic-tampered.jsonDownload 02
The exporter writes a directory with a summary, manifest, detached JWS, embedded public keys, timestamp proof, ledger anchor, and exported artifacts.
<bundle-dir>/ bundle.json manifest.json manifest.jws.json keys/jwks.json timestamp.ots ledger_anchor.json artifacts/exports/... artifacts/index/artifact_index.json
03
Required fields come from the current sealed-bundle contract. Conditional fields appear when the producer records the corresponding scope or evidence-factory detail. Optional fields carry additional export context.
| Field | Status | Purpose |
|---|---|---|
| formatVersion | Required | Selects the sealed manifest format; the current producer emits 1.0. |
| bundleSpec | Required | Identifies evidence-room-bundle-v1. |
| exportId | Required | Binds the manifest to one export. |
| tenantId | Required | States the tenant scope carried by the export. |
| createdAt | Required | Records when the export record was created. |
| exporter.name | Required | Identifies the exporter that produced the bundle. |
| exporter.version | Required | Identifies the exporter version. |
| export.exportId | Required | Must agree with the top-level exportId. |
| export.tenantId | Required | Must agree with the top-level tenantId. |
| export.environment | Required | Records the source environment label. |
| export.platformVersion | Required | Records the platform version supplied by the producer. |
| export.requestedBy | Required | Records the export requester reference. |
| export.requestedAt | Required | Records the export request time. |
| export.sealedAt | Required | Records when the seal was written. |
| export.traceIds | Required | Carries trace references associated with the export. |
| export.policySnapshots | Required | Carries policy snapshot references selected by the exporter. |
| Field | Status | Purpose |
|---|---|---|
| artifacts[] | Required | Lists every exported artifact covered by the Merkle root. |
| artifacts[].path | Required | Resolves the artifact inside the bundle directory. |
| artifacts[].sha256 | Required | States the SHA-256 digest of the artifact bytes. |
| artifacts[].bytes or sizeBytes | Required | Lets the verifier compare the declared size with the file. |
| artifacts[].contentType | Required | Describes the exported file content type. |
| artifacts[].class | Optional | Labels an artifact class such as execution-evidence or artifact-index. |
| artifacts[].provenance | Optional | Carries producer provenance metadata for the artifact. |
| artifacts[].createdAt | Optional | Records when the artifact was created. |
| artifacts[].source | Optional | Links the artifact to a source type and reference. |
| record.decisionRequestId | Optional | Links the bundle to the governing decision request. |
| record.executionId | Optional | Links the bundle to an execution. |
| record.lineageRecordId | Optional | Links the bundle to execution lineage. |
| scope | Optional | Describes the export population or time boundary when supplied. |
| profile | Optional | Records the evidence profile selected by the producer: full, redacted, or minimal. |
| omissions | Optional | Records declared omissions. |
| redactions | Optional | Records declared redaction metadata. |
| Field | Status | Purpose |
|---|---|---|
| merkle.algorithm | Required | Identifies kla-merkle-v1. |
| merkle.rootSha256 | Required | Commits to the sorted artifact path and digest set. |
| integrity.manifestHashAlgo | Required | Identifies SHA-256 for the manifest digest. |
| integrity.manifestHash | Required | Stores the raw hexadecimal digest of the normalized manifest. |
| integrity.signatureAlgo | Required | Identifies the manifest signature algorithm, currently ES256. |
| integrity.signaturePayload | Required | States that the signature payload is MANIFEST_HASH. |
| integrity.signingKeyId | Required | Identifies the producer signing-key reference. |
| integrity.anchors[] | Required | Lists timestamp and ledger anchor records. |
| evidenceFactory.request.requestedArtifacts | Conditional | Drives whether receipt-signatures and ledger-hash-chain are required. |
| evidenceFactory.contractVersion | Conditional | Identifies the Evidence Factory request contract when a factory request is embedded. |
| evidenceFactory.request.tenantId | Conditional | Carries the tenant binding for the embedded Evidence Factory request. |
| evidenceFactory.request.actor | Conditional | Identifies the human or service actor that requested the factory export. |
| evidenceFactory.request.source | Conditional | Identifies the KLA surface that requested the factory export. |
| evidenceFactory.request.scope | Conditional | Carries the chronology and selectors used for the factory export. |
| evidenceFactory.request.redactionProfile | Conditional | States the factory export redaction profile. |
| evidenceFactory.request.idempotencyKey | Conditional | Carries the request idempotency key. |
04
This synthetic manifest uses the same export identifier and record links as the complete execution reference. The companion bundle summary repeats the seal values that the verifier compares.
{
"bundle": {
"exportId": "bundle_manifest_synthetic_20260721_01",
"tenantId": "tenant_synthetic_001",
"manifestDigestSha256": "1bae725ba61cf55f94310e37ee491d3d52145d98da8580df63e0b91fa9968117",
"merkleRootSha256": "cb170b4d42403ed97c4818a723ebd93607902a84159deb4555357bc73a432102",
"artifactCount": 2
},
"manifest": {
"formatVersion": "1.0",
"bundleSpec": "evidence-room-bundle-v1",
"record": {
"decisionRequestId": "dr_01JZ8V4Q4N9K6T2D5B3M7X1S0E",
"executionId": "run_01JZ8V4K2D9A6N3P7M5R1C8X0E",
"lineageRecordId": "lin_01JZ8V4R8A2C6N9Q3S5D7M1T0E"
},
"artifacts": [
{
"path": "artifacts/exports/evidence-export-synthetic.json",
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"bytes": 128,
"sizeBytes": 128,
"contentType": "application/json",
"class": "execution-evidence",
"source": {
"type": "synthetic",
"ref": "run_01JZ8V4K2D9A6N3P7M5R1C8X0E"
}
},
{
"path": "artifacts/index/artifact_index.json",
"sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"bytes": 64,
"sizeBytes": 64,
"contentType": "application/json",
"class": "artifact-index",
"source": {
"type": "synthetic",
"ref": "bundle_manifest_synthetic_20260721_01"
}
}
],
"integrity": {
"manifestHashAlgo": "SHA-256",
"manifestHash": "1bae725ba61cf55f94310e37ee491d3d52145d98da8580df63e0b91fa9968117",
"signatureAlgo": "ES256",
"signaturePayload": "MANIFEST_HASH",
"signingKeyId": "sample-key-sek-synthetic-01",
"anchors": [
{
"type": "immudb",
"status": "NOT_PRESENT",
"reason": "IMMUDB_DISABLED",
"ledger": "immudb",
"proofPath": "ledger_anchor.json",
"valueHash": ""
},
{
"type": "ots",
"status": "PRESENT",
"proofPath": "timestamp.ots"
}
]
}
}
}Valid seal values
The manifest digest is 1bae725ba61cf55f94310e37ee491d3d52145d98da8580df63e0b91fa9968117. The Merkle root is cb170b4d42403ed97c4818a723ebd93607902a84159deb4555357bc73a432102.
Cross-reference
The record fields and export identifier connect this file to the complete sanitized execution record and its evidence.manifest_ref.
05
The production verifier treats bundle bytes and manifests as untrusted input and fails closed when a required check fails. The procedure has six named checks.
manifest-signature
Normalizes the manifest, computes the JCS/SHA-256 digest, compares the manifest and bundle summaries, checks the detached payload, validates ES256 SEK and TEK signatures against embedded non-revoked keys, and validates declared anchor paths.
receipt-signatures
When governance EvidenceEntry[] material is present, verifies Ed25519 receipt signatures, embedded keys, revocation state, and prevReceiptHash links. Unsigned receipt material follows the verifier’s explicit unsigned-receipt path.
ledger-hash-chain
When governance EvidenceEntry[] material is present, recomputes ledger record hashes, applies recorded redaction transforms, checks entry hashes, and requires one connected ledger component.
merkle-inclusion
Resolves each declared path inside the bundle, compares file size and SHA-256, recomputes kla-merkle-v1, checks inclusion proofs when supplied, and compares the root and artifact count with bundle.json.
ots-anchor
Parses timestamp.ots, checks its SHA-256 commitment against the manifest digest, and accepts a pending calendar proof or a Bitcoin attestation within the offline verifier’s trust boundary.
pii-absence
Runs only when the caller supplies forbidden markers. It scans bundle files as bytes, reports masked marker digests, and fails when a listed file or the manifest cannot be read.
The declared digest reproduces from the normalized manifest. The declared Merkle root is computed from the two sorted artifact entries. A complete on-disk bundle supplies the bytes and detached signatures for the remaining checks.
The tampered file changes one artifact sha256 from the valid example while retaining the original manifest digest and Merkle root. The manifest remains schema-valid. Digest comparison fails, and the full merkle-inclusion check also compares the declaration with the artifact bytes.
06
These repository sources define the producer, manifest contract, verifier, and individual checks described here.
| Contract | Repository source path | Mapping | Status |
|---|---|---|---|
| BundleManifest / BundleJson | packages/evidence-verifier/src/types.ts | Defines manifest, summary, artifact, anchor, record, JWS, JWKS, check, and verification shapes. | Current source |
| Sealed manifest contract | packages/evidence-contract/src/index.ts | Validates the producer’s required formatVersion, export, artifact, Merkle, record, and integrity fields. | Current source |
| Bundle producer | services/evidence-exporter/src/export-api.ts | Writes bundle.json, manifest.json, detached JWS, JWKS, OTS proof, ledger anchor, and artifact index. | Current producer |
| Verification orchestration | packages/evidence-verifier/src/verifier.ts | Loads untrusted bytes, chooses conditional checks, and fails closed across the applicable result set. | Current verifier |
| Manifest and Merkle checks | packages/evidence-verifier/src/checks/manifest-signature.ts; packages/evidence-verifier/src/checks/merkle-inclusion.ts | Verifies digest/signatures/summary consistency and artifact bytes, paths, sizes, hashes, and root. | Current checks |
| Evidence and anchor checks | packages/evidence-verifier/src/checks/receipt-signatures.ts; packages/evidence-verifier/src/checks/ledger-hash-chain.ts; packages/evidence-verifier/src/checks/ots-anchor.ts; packages/evidence-verifier/src/checks/pii-absence.ts | Verifies conditional receipt and ledger evidence plus OTS and opt-in marker scans. | Current checks |
Implementation source
The links above point to the current repository contract, exporter, and verifier. The documentation-layer reference helper lives at /ai-agent-evidence-bundle-manifest/v1/verify.ts; the production procedure remains the package verifier.
07
The implementation boundary stays visible in the answers below.
bundle.json is the short seal summary. manifest.json is the full export manifest with artifact entries, record links, scope metadata, and integrity anchors. The verifier compares their shared identifiers, digest, Merkle root, and artifact count.
The verifier requires them when the evidence factory requests execution-evidence or raw-evidence, when the requested-artifacts field is missing, or when evidence files or evidence-loading errors are present. A bundle without those signals receives explicit not-required results for the two checks.
The manifest binds the export to its declared tenant and record references. Authorization and tenant-isolation decisions are evaluated by the services that create and expose the records. The bundle verifier checks the sealed bundle’s internal consistency and integrity.
It changes one artifact sha256 while keeping the original Merkle root and manifest digest. The manifest remains structurally valid, while digest comparison fails. A full on-disk verification also compares the changed declaration with the artifact bytes and Merkle root.
The offline checks parse the local timestamp and ledger-anchor files. The OTS check can recognize pending or Bitcoin-attested proof structures. Network confirmation belongs to a separate operational procedure.
Start with the action request, policy decision, approval, and audit event schemas. Then inspect the complete execution record and evidence-room sample.