nexart.iodocs

    Certificate Hash vs Project Hash

    Two hash types, two scopes. One for single executions, one for multi-step workflows.

    Mental model
    • certificateHash binds one execution.
    • projectHash binds many executions into one workflow.
    • Both are deterministic. Both must be recomputable.

    Comparison

    certificateHashprojectHash
    ScopeSingle execution (one CER)Multi-step workflow (Project Bundle)
    AlgorithmSHA-256 of canonical CER bundleSHA-256 of canonical Project Bundle
    CoversbundleType, version, createdAt, snapshot, contextAll steps, ordering, per-step CER data, metadata
    Verification URL/c/:certificateHash/p/:projectHash
    SDK (sync)verifyCer()verifyProjectBundle()
    SDK (async)verifyCerAsync()verifyProjectBundleAsync()

    What is hashed (certificateHash)

    The certificateHash is computed as SHA-256 over a strict whitelist projection, canonicalized per the profile selected by protocolVersion (1.2.0 → nexart-v1, default; 1.3.0 → jcs-v1 / RFC 8785, opt-in). It is computed ONLY over:

    • bundleType
    • version
    • createdAt
    • snapshot
    • context (only if present)
    • contextSummary (only if present)
    • policyEvaluation (only if present)

    What is NOT hashed

    The following fields are explicitly excluded from the certificate hash payload:

    • certificateHash
    • meta
    • declaration
    • verificationEnvelope
    • verificationEnvelopeSignature
    • receipt
    • any unknown fields not in the whitelist

    Canonicalization is protocol-bound. Verifiers MUST apply the whitelist projection to the bundle as received and use the canonicalization profile corresponding to the bundle's protocolVersion. No reconstruction. No field stripping or addition.

    Tamper Evidence

    Both hashes are tamper-evident. Any modification to a covered field produces a different hash, making changes immediately detectable during verification.

    When to Use Each

    • Use certificateHash when you are certifying a single execution: one AI call, one tool invocation, one deterministic operation.
    • Use projectHash when you are certifying a multi-step workflow: an agent run with multiple tool calls, a pipeline with sequential stages, or any process where the relationship between steps matters.

    Independence

    Each CER inside a Project Bundle retains its own certificateHash. You can verify any individual step by its certificateHash without needing the full Project Bundle. The projectHash provides an additional guarantee that the entire workflow is intact.

    See Certified Execution Records and Project Bundles for full details on each artifact type.