An in-toto predicate type

capability/v1

A signed statement that a named tool read these Velaris source files, byte for byte, and reports this capability surface: the effects the program declares, the paths, hosts and modules it names, and the narrowest budget to run it under.

Predicate type: https://gowrishankar-infra.github.io/velaris-lang/capability/v1 - this page.
Schema: schema.json, JSON Schema draft 2020-12, for the predicate.
Definition: velaris-spec SPEC.md section 8.5, dedicated to the public domain under CC0.

What it is

A velaris.audit/1 document (velaris-spec section 8) names no file and carries no signature. This predicate type puts one inside an in-toto Statement v1, whose subjects are the files audited, identified by digest, so that a signed Statement says which source the audit describes, and who says so.

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {"name": "examples/effects.vel",
     "digest": {"sha256": "e483365ce74a20770a1ef503f185f4de2c16b0524797408784a235e78b6baafb"}}
  ],
  "predicateType": "https://gowrishankar-infra.github.io/velaris-lang/capability/v1",
  "predicate": {
    "producer": {"name": "velaris-lang",
                 "uri": "https://github.com/gowrishankar-infra/velaris-lang"},
    "specification": "velaris-spec 0.5",
    "auditedAt": "2026-09-11T00:00:00Z",
    "audit": {"schema": "velaris.audit/1", "velaris_version": "8.1.0",
              "ok": true, "effects": ["clock", "fs", "io", "rand"],
              "safe_command": "velaris <file> --allow clock,fs:read:report.txt,fs:write:report.txt,io,rand",
              "counts": {"fs": 2, "net": 0}, "prover": true,
              "...": "the rest of the audit"}
  }
}

Fields

Field	Required	Meaning
`subject[0]`	yes	the file audited: `name`, its path as the producer was given it, `/`-separated; `digest.sha256` of its bytes. The files it imports should follow, one subject each.
`predicate.audit`	yes	a `velaris.audit/1` document produced from exactly the bytes the subjects name
`predicate.producer`	yes	`name` of the implementation that wrote the audit, and optionally `uri`; its version is the audit's `velaris_version`
`predicate.specification`	no	the velaris-spec version followed, as `velaris-spec 0.5`
`predicate.auditedAt`	no	when the audit was made, RFC 3339 in UTC, by the producer's clock
`predicate.conformance`	no	the conformance levels the producer claims (velaris-spec CONFORMANCE.md) and the corpus it ran - a claim, not evidence

Parsing rules

In-toto's standard parsing rules apply. Ignore any field you do not know, in the predicate and in the audit. Fields may be added within v1; a change of meaning is a new type, .../capability/v2. Check that the first subject's digest is the digest of the file you mean to trust.

What it does not say

That the audit is right, that the program is safe to run, or that any runtime will enforce the budget in safe_command. When audit.ok is false, it says nothing about what the program may do. It says that the signer ran the producer on these bytes and got this audit.

A producer

velaris-lang writes Statements of this type, from 4.2:

velaris attest program.vel --output program.intoto.json

It signs none; cosign (cosign attest-blob --statement) and sigstore-python sign them, as EMBEDDING.md shows. Every release of velaris-lang carries one for an example program, signed by its release workflow and verified there; velaris-spec's example was written by velaris attest.