Socair attestation

A Socair report about one model artifact, signed by whoever ran the scan. The predicate is the report itself.

Shape

Envelope: An in-toto Statement v1 (https://in-toto.io/Statement/v1) in a DSSE envelope with payload type application/vnd.in-toto+json, signed with Ed25519. It verifies offline: no transparency log or certificate authority is involved.
Subject: One subject: the artifact by file name and SHA-256. For a model directory, the digest of its canonical manifest (socair.modeldir/v1), which lists every file’s hash.

socair.report/v1: The whole predicate is a report document: the artifact’s identity, every check row with its status (PASS, FAIL, LEAD, NOT_TESTED), the promotion state, the bounded statement, and what the report does not certify.

socair sign --key operator.key --report report.json
socair verify report.dsse.json --trusted operator.pub \
  --artifact model.gguf

The signature binds the artifact hash, the report, and the signer’s key. It does not make the report claim more than its bounded statement: a signed report still certifies only what it says it tested.
The issuer is whoever signs. An unsigned report names no issuer, and Defilan does not issue attestations for anyone else’s models.
The checks a verifier runs (envelope, signature, statement, subject digest, promotion state) are in the public Go module github.com/defilantech/socair-verify, the same code LLMKube’s admission gate runs.