The Ed25519 signature authenticates the exact public manifest bytes, including the release inventory. The manifest in turn binds this run's source aggregate by its SHA-256 digest and byte size.
- Configuration key
- config-cc67c176ea6b2dfd3786955295723e7abe2b413c7adaa05bf3fc46adee759a6a
- Campaign ID
- 282234b0-56fa-5f05-81c4-9d21905b7769
- Comparison group ID
- valuation-financial-modeling-0.2.0-dev-configuration-specific-v1
- Signed release ID
- 1dc37e8d-ffda-48f4-a2ad-6fa9b91eb97a
- Release ID
- c44af57d-9091-45c8-9299-96dee423e175
- Publication key ID
- kaelum-bench-public-release-20260718-v1
- Manifest SHA-256
- caa004fcccade516afe661a318e69b555844595cbcd726cdc749ff3c64a6378f
- Source aggregate
- fmb-live-runs-fin-val.json
- Source aggregate SHA-256
- 1c741e9270d8cdc54ac0d10b329aa23a3c28d6b2a7dad4100b1b41de46f68e8b
- Source aggregate bytes
- 15,040
Verify the evidence chain
- Verify the detached Ed25519 signature over the domain-prefixed exact manifest bytes using the published public key.
- Confirm that the sidecar payload SHA-256 equals the manifest SHA-256 shown above.
- Hash the source aggregate and compare its SHA-256 and byte size with the signed manifest entry.
- Resolve this run ID through the public run index and match its campaign ID inside that aggregate.
node -e 'const fs=require("node:fs"),c=require("node:crypto"),m=fs.readFileSync("public-manifest.json"),s=JSON.parse(fs.readFileSync("public-manifest-signature.json","utf8")),k=fs.readFileSync("kaelum-bench-public-release-20260718-v1.pem");console.log(c.verify(null,Buffer.concat([Buffer.from("kaelum-bench-fmb-public-release-v1\0"),m]),k,Buffer.from(s.signature_base64,"base64")))'