nexart.iodocs

    Evidence Bridge

    Transform existing application JSON or OpenTelemetry spans into deterministic, confidential, cryptographically verifiable AI and consequential execution evidence.

    NexArt Evidence Bridge converts the JSON your application already produces into structured, cryptographically verifiable execution evidence.

    Most applications, agents, workflow systems and automation platforms already emit execution data. The challenge is that every system structures that data differently.

    Define and publish a deterministic mapping profile once. Your application can continue sending its existing JSON instead of constructing NexArt Certified Execution Records directly.

    Before you start
    • A NexArt account. Sign in at nexart.io/dashboard.
    • An API key, sent as Authorization: Bearer <NEXART_API_KEY>.
    • One example of the JSON or OpenTelemetry span your system already produces.
    Your first record, in order
    1. Sign in and create an API key
    2. Check the service is ready: GET /ready (see the API reference)
    3. Create and publish a mapping profile
    4. Send one event
    5. Verify the result
    6. Optional: request Node attestation as a separate step

    For each accepted event

    • the customer and source request are authenticated and validated
    • an immutable published profile maps the source data
    • source hashes, mapping provenance and profile identity are recorded
    • the selected evidence type is checked for required semantics
    • the applicable evidence record is created and verified locally
    • the result and certificate identity are persisted
    • the unchanged evidence can optionally be submitted to NexArt Node

    Architecture

    Evidence Bridge pipeline
    Source JSON
      |
Deterministic mapping profile
      |
Mapped event
      |
Evidence eligibility
      |
Evidence inclusion / disclosure policy
      |
Consequential or AI CER creation
      |
Local verification
      |
Persisted Bridge result
       |
       | Optional, separate request
       v
NexArt Node attestation
       |
Independent verification

    Evidence Bridge transforms and verifies declared execution data. It does not run your application, execute your AI, evaluate policy, or decide whether the underlying action was correct.

    Ingestion and Node attestation are separate operations; ingestion does not attest automatically. AI Execution evidence is always sealed with Protected input and output. A Consequential CER may contain Protected whole fields, Readable whole fields, or a mixture of both, as set by the profile's disclosure policy.

    When to use Evidence Bridge

    Use Evidence Bridge when your application already emits useful execution JSON and you need:

    • deterministic, reviewable mappings without replacing the source format
    • cryptographic evidence identity and field-level provenance
    • confidential commitments for sensitive fields
    • optional NexArt Node attestation without rebuilding or resealing evidence
    • an incremental path to NexArt evidence

    Common sources include AI and agent executions, model requests and responses, operational actions, deployments, rollbacks, refunds, approvals, account actions, infrastructure remediation and OpenTelemetry AI execution spans.

    Why Evidence Bridge exists

    Without Evidence Bridge, every system integrating with NexArt would need to construct NexArt evidence records directly. That works well for systems designed around the NexArt SDKs, but many existing platforms already have their own execution formats.

    For example, one system might report:

    {
  "execution_id": "exec_123",
  "action_type": "NODE_ISOLATION",
  "outcome": "APPLIED"
}

    while another might report:

    {
  "runId": "run_456",
  "operation": "isolate_node",
  "status": "success"
}

    The source semantics may be similar even though the JSON structures are completely different. Evidence Bridge solves the adaptation problem by keeping the mapping layer separate from the evidence layer:

    Source schema
    |
Mapping
    |
Normalized execution semantics
    |
Evidence target

    This separation means NexArt does not need a new cryptographic protocol for every source platform.

    Map once. Execute deterministically.

    Mapping profiles are created and reviewed before production use. AI may eventually assist with suggesting mappings during onboarding, but AI is not part of the production mapping path. Once a mapping profile is published, transformations are deterministic.

    Production rule
    same source payload
+ same mapping profile revision
+ same mapping engine version
= same mapped result

    Mapping execution:

    • does not call an LLM
    • does not execute arbitrary JavaScript
    • does not perform network lookups
    • does not allow user-supplied executable functions

    This keeps the transformation reproducible and auditable.

    Supported evidence targets

    AI Execution V2. Record family cer.ai.execution.v2, protocol 1.3.1, SDK @nexart/ai-execution. Use when the source represents an actual AI or model execution. See AI Execution through Evidence Bridge.

    Consequential Execution. Canonical record family cer.consequential.execution.v1, protocol 1.3.1, SDK @nexart/consequential-execution. Use when the source represents a consequential system action or state-changing execution: infrastructure remediation, deployment, workflow state changes, financial operation execution, agent tool actions that actually execute, automation actions, resource isolation, configuration changes. See Consequential Execution.

    A tool call, authorization decision, proposal, or model recommendation is not automatically a consequential execution. The source must contain sufficient evidence that an execution was attempted and report its outcome.

    System ownership

    Three services, three responsibilities
                        nexart.io
              Control Plane / Dashboard
              -------------------------
              Identity
              Plans
              API keys
              Entitlements
                    |
            short-lived handoff
                    |
                    v
              bridge.nexart.io
               Evidence Bridge
              -----------------
              Mapping profiles
              Source hashing
              Deterministic mapping
              Target eligibility
              Confidential CER creation
              Local verification
                    |
              exact sealed CER
                    |
                    v
               node.nexart.io
             Attestation Node
              -----------------
              CER verification
              Ed25519 receipt
              RFC 3161 timestamp
              Public resolution
    Machine clients
    Source application
      |
      | NexArt API key
      v
Evidence Bridge
      |
      | exact customer-attributed CER
      v
NexArt Node

    Where to go next

    Start and verify