Per-resource integrity for multi-file artifacts (ADR-0009 follow-up), and version-bound environment-validation attestations

[snapsynapse]

Two observations for the Trust Manifest, both anchored to items this project has already identified:

1. Archive-level digests leave multi-file artifacts unverifiable after extraction (ADR-0009's open action item on entry-level digests).
2. The attestation vocabulary covers organizational controls but not environment validation, the risk class specific to AI artifacts.

I arrived via the Agent Skills versioning threads (agentskills/agentskills#46 and agentskills/agentskills#254), where these questions are being worked through for one specific artifact type. Working implementations exist for both items; I maintain them, and offer them as prior art and evidence of implementability, not as proposals to adopt as-is.

1. Post-extraction integrity for multi-file artifacts

Gap. For single-file artifacts, provenance.sourceDigest binds the entry to its content. For multi-file artifacts (relevant given planned support for Agent Skill manifest files as an entry type: bundles of instructions, scripts, and assets), an archive-level digest verifies the artifact at fetch time and nothing afterward. Once unpacked, modification of individual files produces no integrity signal, and these artifacts are routinely redistributed out of band, beyond the reach of catalog re-verification.

Direction. The artifact carries an internal manifest listing per-file sha256 digests, and the catalog-side digest covers the artifact bytes including that manifest. Verification chains: the catalog digest binds the bundle, the internal manifest binds the files, and file-level verification remains possible where the catalog chain is unreachable. This is the content-addressability direction ADR-0009 records ("digests all the way down"), extended to file granularity, functional without OCI infrastructure where none is available.

Evidence. skill-provenance (MIT): manifest format and a zero-dependency verifier, deliberately small enough to be audited in full before use.

2. Version-bound environment-validation attestations

Gap. The adding-trust guide's attestation vocabulary covers organizational controls (SOC2, ISO 27001, publisher identity). AI artifacts carry a risk class those frameworks do not address: identical bytes can behave materially differently depending on the harness and model interpreting them, so an artifact can degrade silently across runtime changes with no integrity violation.

Direction. A structured attestation type recording what an artifact version was validated against. Illustrative shape only; field names and placement are this group's to decide:

{
  "type": "environment-validation",
  "artifactVersion": "5.1.0",
  "harness": "example-harness",
  "model": "example-model-id",
  "date": "2026-07-16",
  "result": "pass"
}

Two constraints matter for the control design:

• Version binding. An attestation for one artifact version asserts nothing about the next. Leaving the binding implicit reproduces the freshness problem the adding-trust guide already notes for compliance attestations (no built-in expiry; validity in free text is difficult to audit).
• Class separation. Integrity verification gates; environment attestation informs. A stale validation record on an integrity-intact artifact is a signal to re-validate, not an availability failure. Permitting attestation state to veto integrity-verified content would let the weaker control override the stronger one.

Evidence. A version-bound implementation ships in the reference implementation above (validated_against, v5.1.0). A version-range binding (applies-to) is in production in GuideCheck, a .well-known trust artifact with an independent-verifier conformance ladder, if third-party conformance attestations become in scope.

---

If either direction is worth pursuing, I'm glad to draft example documents or CDDL text as a follow-up PR, consistent with the contributing guidance of agreeing on direction before detailed text. If there is a better venue or an existing owner for either item, I'll defer to that.

Provenance note: human-directed, AI-assisted, human-verified. If it's worth publishing, it's worth attesting.