Skip to content
Zeta-Reticuli AIZeta-Reticuli AIZeta-Reticuli AI

Verifying a signed task record

Every executed agent task produces one in-toto Statement v1 with predicate type https://zeta-reticuli.ai/attestations/agent-task/v1, signed with cosign as a DSSE envelope inside a Sigstore bundle (*.sigstore.json).

  • subject: the task outputs (name and sha256).
  • predicate: occupation (SOC code), O*NET task id and the hash of its statement, task class, tenant, the agent’s SPIFFE ID, model provider and id, every source read (title, URI, license, retrieval date, sha256), human approvals, start and finish times.

Status: Available as a sample. The example is a Statisticians (15-2041.00) task 8953 record on synthetic data, signed with a file key (ECDSA P-256). Real agent tasks are not signed yet (Planned).

Verify (offline)

Section titled “Verify (offline)”

You need cosign v3, the public key cosign.pub, the bundle and the output file. Download the sample files from this site (synthetic data):

Terminal window
mkdir -p examples/15-2041.00-8953
curl -fsSO https://zeta-reticuli.ai/evidence/cosign.pub
for f in statement.sigstore.json statement.json report.md; do
  curl -fsS -o examples/15-2041.00-8953/$f https://zeta-reticuli.ai/evidence/examples/15-2041.00-8953/$f
done

Or open /evidence/ in your browser. Then, from that directory:

Terminal window
cosign verify-blob-attestation --key cosign.pub --insecure-ignore-tlog \
  --type https://zeta-reticuli.ai/attestations/agent-task/v1 \
  --bundle examples/15-2041.00-8953/statement.sigstore.json examples/15-2041.00-8953/report.md
# Verified OK

This checks the signature against cosign.pub, the predicate type, and that the sha256 of report.md is a subject of the statement. Change one character in report.md and it fails (provided artifact digests do not match digests in statement); edit the predicate in the bundle and it fails (accepted signatures do not match threshold).

Read the signed record:

Terminal window
jq -r .dsseEnvelope.payload examples/15-2041.00-8953/statement.sigstore.json | base64 -d | jq

What this does not prove yet

Section titled “What this does not prove yet”

The sample is not uploaded to a transparency log (Rekor) and has no trusted timestamp, so verification needs --insecure-ignore-tlog and the times in the record are only as trustworthy as the signer. This is what lets it work air-gapped. Planned, not tested: keys in OpenBao or your cloud KMS, a public or private Rekor or an RFC 3161 timestamp authority, and keyless signing bound to the agent’s SPIFFE ID (--certificate-identity spiffe://<tenant>.reti-infra.com/onet/<soc>). Your assurance profile’s evidenceSigning section chooses among these.