sanning-io/proof,
alongside the kernels that read them and the conformance corpus that grades both. Those
documents are normative. This page tells you which one answers which question.
Anything on this site that describes a format is a plain reading of one of them. Where the
two differ, the specification is right.
The parts worth reading first
evidence-bundle.md §5.3.4 draws the boundaries on what a verdict claims. If you are
deciding how much weight to put on a verified result, read that section rather than this
site’s summary of it.
envelope-spec.md §2 requires readers to ignore fields they do not recognise. That
rule is what keeps every proof ever issued verifiable as the format grows, and it has a
sharp edge worth knowing: a field bolted onto a body type a reader does not dispatch on is
silently ignored rather than rejected.
log-store.md §4 explains why the store and the hand-over pack are laid out
differently on purpose, and why unifying them would break either an auditor’s ability to
find a file or a traversal defence.