Artifact integrity

Evidence format

submitDelivery() stores one non-zero bytes32 evidence hash. The escrow does not fetch, inspect or retain the underlying artifact.

Evidence envelope

The current envelope uses SHA-256 digests for delivered files, a commit identifier, runtime fingerprint and log digest. Retrieval locations carry no integrity by themselves; downloaded bytes become evidence only when they match the digest committed in the statement.

statement
  files[] → path + sha256
  commit  → source revision
predicate
  runtime → pinned environment
  log     → sha256
artifact_ref / logs_ref → retrieval only

Producer procedure

  1. Freeze the acceptance-criteria JSON before the seller signs.
  2. Collect delivered bytes without newline, archive or filename transformations.
  3. Compute a digest for every artifact and log from the exact byte stream.
  4. Build the statement in the documented in-toto shape and sort subjects by UTF-8 bytes.
  5. RFC-8785-canonicalize the statement, SHA-256 hash those canonical bytes and retain both forms.
  6. Put that digest in artifact_hash and submit the same value, 0x-prefixed, to the escrow.

Consumer procedure

  1. Read the on-chain evidence hash and termsHash from the deal.
  2. Resolve the envelope and underlying artifacts from the agreed locations.
  3. Recompute the canonical statement digest and require it to equal both artifact_hash and the on-chain evidence hash.
  4. Recompute each artifact and log digest from retrieved bytes.
  5. Pin the source revision and runtime before evaluating criteria.
  6. Record Pass only when all required checks reproduce; otherwise use the documented Fail/Inconclusive distinction.

Criteria commitment

For the current schema-validity verifier, termsHash is the SHA-256 of RFC-8785-canonical acceptance-criteria JSON. The escrow stores that value as opaque bytes; the verifier reproduces and checks it.

Dispute evidence

While a deal is disputed, buyer and seller can call submitEvidence(). The contract emits an ERC-1497-shaped Evidence event and stores nothing. Availability and interpretation remain outside the escrow.

Common failure modes

FailureMeaningResponse
Retrieval location unavailableAvailability failed; integrity is not yet knownPreserve the request failure and do not infer Pass.
Envelope digest mismatchThe retrieved statement is not the committed statementStop before evaluating nested criteria.
Artifact digest mismatchRetrieved bytes differ from the statementRecord the mismatch as evidence.
Runtime cannot be reproducedThe result cannot be independently repeatedUse Inconclusive unless signed criteria explicitly define another result.
Criteria are subjectiveDeterminism is impossible from bytes aloneDo not manufacture an objective verifier rule; rely on the agreed challenge/arbitration path.
Current limitationNo hosted verifier or artifact storage service is a public production service. The envelope's display signature carries no authority of its own; the seller's on-chain submitDelivery() call is what binds the evidence hash to the seller role.
← Deal lifecycleIdentity anchors →