Warranty predicate v1

https://docs.permafrost.live/reference/warranty-predicate-v1/ is the predicateType of an in-toto Statement (v1) written by

pf-verify warranty export bundle.json --format in-toto --members members.json

It describes a warranty: an issuer’s signed claims about an exact set of files issuer-claimed, plus what the deployment witnessed at issue witnessed.

Statement

Field	Value
_type	https://in-toto.io/Statement/v1
subject	one entry per file, in set order (below)
predicateType	https://docs.permafrost.live/reference/warranty-predicate-v1/
predicate	{ warranty, witnessed, bundle } (below)

The Statement is unsigned; its authority is the issuer’s signature and the deployment’s witness statement in predicate.bundle. Add your own envelope if needed.

Subjects

Field	Value
name	the file’s bucket/key as recorded at write
digest.sha256	the SHA-256 of the file’s bytes; present only when the recorded fingerprint is that plain SHA-256, absent for a salted or stored one
digest.permafrostPutLeaf	lowercase hex of the file’s own ledger entry hash: a fixed reference to that recorded write

Tools that don’t know permafrostPutLeaf ignore it, as the in-toto digest rules allow.

Predicate

warranty:

Field	Meaning
id	the warranty’s id
deployment	the deployment that recorded it
issuer	the issuer’s Sui address
setRoot	the Merkle root over the set’s ledger entries
setCount	how many files the set holds
setRule	how the set was named: a list of files, or an agent-space selector
claims	the issuer’s claims, decoded (licence, consent, region, excluded-from, delivered-to, outcome, derived-from)
nbf, exp	when the warranty starts and ends (milliseconds since the Unix epoch)
state	issued or expired
remaining	how many files are still in the set

witnessed: at (witness time, milliseconds since the Unix epoch) and what the deployment saw itself, e.g. files held, declared region, archive backends holding copies, files the named buyer read in full at the warranted version.

bundle: the warranty bundle. Check it without calling Permafrost:

pf-verify warranty bundle.json --signer-pk <the ledger key> --sui-log <the Log id> --rpc <a Sui gRPC url>

Export rules

• Only a verifying bundle is exported, and only with every set member, so the subjects rebuild the set’s root and count.
• An empty set is not exported: a Statement needs at least one subject.
• A retracted warranty is not exported (exit code 4).

The full encoding comes with onboarding.