Process and evidence integrity
Decision Passport · 2
Anatomy of a passport
The sample below is a real bundle produced by this code: a Deep Analysis passport for the fictional sample service agreement, drafted, reviewed by a second person and issued. It is the conformance fixture both verifiers run in CI. It is signed with a test key (pinned only in the conformance key list, its private half discarded), so the portal, which trusts only the production key, will correctly reject its signature.
Download the sample bundleDownload the bound Deep Analysis bundle
1.The envelope
The outer fields of the bundle file.
| bundle | abrahammoses-decision-passport-bundle | Identifies the file as a passport bundle. |
|---|---|---|
| schema_version | 1.0.0 | Bundle schema; verifiers refuse versions they do not know. |
| passport_id | DP1-eyJhIjp7fSwiZCI6InBkX3Rlc3QwMDAxIiwi… .S-VpoPlnCVrd… | DP1- + base64url(canonical JSON of the state), then .S- + base64url(signature). The ID alone names the state and carries the signature. |
| integrity.passport_sha256 | 6611977ed392bfac5108be8a2cc5985a8e57c27b8aba368fc4aad7a2affdea83 | SHA-256 over the canonical JSON (canonical-json/1, RFC 8785 style) of the passport artifact. |
2.The seven artifacts
Each artifact is hashed separately in integrity.artifacts; a verifier recomputes all seven.
2.1passport
6611977ed392bfac5108be8a2cc5985a8e57c27b8aba368fc4aad7a2affdea83The attested content: subject (the sealed report and document hashes), analysis engine and model, outcome, findings, cited spans, proposer and reviewer, timeline, policy, audit trail, attests / does-not-attest, limits. Its canonical-JSON SHA-256 is the passport hash that is signed.
2.2report_markdown
10dc94b1d0f423d3a66ad6451c35da47081dd0cc1a3bf8d9438ea18460f73957A human-readable rendering of the passport. Informational: hashed, but the passport is the authority.
2.3state
71c7bd4dde9f8cbc60d5ff4af4cafc95d9011269722202ec9d8c420d97b55224The compact state the passport ID encodes: kind, workspace, draft id, status and time.
2.4sources
389e5a35d45099d3c89afaa14f7db3d6d1af92a428bee935fd737f2ced3f2186The source inventory and the source documents: here the report metadata (no document text). Each document must hash to its inventory entry.
2.5release
cf1280f0d93114897dd900da1570690b285ba01a39e88066ce3dd3025f19a972The release manifest: ruleset, case (the draft) and content hash, and the frozen engine with its source SHA-256.
2.6review
484b1ecf6e6fd7e31a2e85608bc7291357bfd81854e5e646f6b19c9163a1f64eReview status and reviewer, which must equal those in the passport, plus any reviewer attestations.
2.7crypto
f3d169655660f0de592ad1753dfa9506e0707e69f2ce9bce274ec53ee46db24dThe issuance signature (Ed25519, key id, issue time, value), where to fetch public keys, and an informational key copy. Verifiers use their pinned keys, never this copy.
3.Inside the passport
Selected fields of the passport artifact, as issued.
| Field | Value in the sample | Meaning |
|---|---|---|
| status | issued | Lifecycle status at the passport time; only issued passports are signed. |
| subject.report_sha256 | 345e8f6937d845a071fba06600dabe8bb117d09dfc3c866aabc2711d81be2237 | The seal of the Deep Analysis report this passport is bound to. |
| subject.document | md, 4414 bytes, text SHA-256 81bbb729a46f5f7d… | The analysed document, by hash. The text itself is not in the passport. |
| analysis_engine | deep-analysis/1.0.0; AI layer: not_configured | What produced the findings. When the AI layer ran, provider, model and prompt version are recorded. |
| outcome | significant_concerns; confidence low | The report's Final Statement rating, as the analysis gave it. |
| findings / spans | 44 findings, 27 cited spans | Every span carries its quote and SHA-256; a changed quote breaks the hash. |
| proposer / reviewer | {"role":"proposer","uid":"uid-proposer","email":null}{"role":"editor","uid":"uid-editor","email":"editor@example.test"} | Account ids and roles; an email address appears only with that person's consent. Placeholder ids in this sample. |
| timeline | drafted 2026-10-21T10:00:00Z; reviewed 2026-10-21T10:30:00Z; issued 2026-10-21T10:31:00Z | Second-precision times; the issue time is the signature time. |
| policy | am-passport-policy/1.0.0 | The Passport Policy that applied, with its digest. |
| audit | DRAFTED → SUBMITTED → APPROVED → ISSUED | The draft's audit events up to issue, in order. |
| engine | am-da-passport-1.0.0 e4aeeaee88bf75c5… | The frozen record builder; verifiers accept only pinned engine hashes. |
4.The signature
Algorithm Ed25519, key ed25519-7e933737ff72e02a, issued 2026-10-21T10:31:00Z. The signed bytes are the UTF-8 string
AbrahamMoses Decision Passport issuance v2 6611977ed392bfac5108be8a2cc5985a8e57c27b8aba368fc4aad7a2affdea83 ed25519-7e933737ff72e02a 2026-10-21T10:31:00Z
The prefix separates passport signatures from any other use of the key (revocation lists are signed under a different prefix).
Disclaimer. A passport attests to process and evidence integrity, not legal correctness. It is not legal advice, not a qualified electronic signature or seal, and not a certification; no regulatory approval is claimed.