Evidence Bundle Export Format
Source-verified against commit
2021a48f6e(2026-10-05). Re-verify the named source contracts before applying this description to an installation. Re-verify:git show HEAD:src/Evidence/__Libraries/StellaOps.EvidenceLocker.Infrastructure/Services/EvidenceBundlePackagingService.cs.
The production exporter copies the native sealed package produced by EvidenceBundlePackagingService. It does not synthesize a VEX gate-results file.
Produced archive
The export filename is evidence-bundle-<bundle-id>.tgz. The package contains:
| Entry | Content |
|---|---|
manifest.json | The signed manifest payload’s JSON value. |
signature.json | The signature envelope and associated signature metadata. |
bundle.json | Bundle metadata. |
checksums.txt | Manifest-entry hashes and the bundle root hash. |
instructions.txt | Package inspection and signature-verification instructions. |
The manifest references immutable materials. The package is not the earlier proposed directory tree of embedded SBOMs, OpenVEX statements, VexLens consensus and findings/gate-results.json. Inspect each material reference rather than assuming that its bytes are included in this archive.
Verification boundary
Resolve independently trusted public custody. Verify the original signed payload bytes and check that manifest.json has the same JSON value. Compare material digests and the manifest root against the declared evidence. Signature-looking metadata is not a verified signature.
The producer is src/Evidence/__Libraries/StellaOps.EvidenceLocker.Infrastructure/Services/EvidenceBundlePackagingService.cs; PostgresEvidenceBundleExporter copies its stored package to the export job output.
For VEX decisions, see decision hashes and provenance. For promotion evidence, see the owning contract.
The earlier design is frozen history. It does not describe the current runtime.