nexart.iodocs

    Glossary

    Short, precise definitions for the vocabulary used across the NexArt docs, each linked to the page that owns the concept.

    AIEF

    A framework projection that verifies an AI Execution CER (V1 or V2) and returns a single PASS/FAIL result with a reason and four checks. See AIEF.

    Attestation

    A signed receipt issued by the NexArt attestation node witnessing that a producer-sealed artifact existed at a point in time. The node never creates or replaces certificateHash. See AI Execution CER.

    Canonicalisation

    The deterministic, byte-level serialization applied to a bundle before hashing. Profiles include nexart-v1 and jcs-v1, each bound to a specific protocolVersion. See Versions.

    CER (Certified Execution Record)

    The smallest unit of proof in NexArt: a tamper-evident record of a single AI execution step, identified by its certificateHash. See AI Execution CER.

    certificateHash

    SHA-256 hash computed over a CER's canonical bundle. It is the canonical identity of a CER. See AI Execution CER.

    Commitment

    A one-way HMAC-SHA256 binding of a field's content plus a random salt,"hmac-sha256:" + hex(...), used in confidential mode. Not encryption: it never reveals or recovers the original value on its own. See AIEF.

    Confidential Mode

    Sealing selected fields (input, output, instruction, or a decisionRef) as commitments instead of plaintext. See AIEF.

    decisionRef

    A reference to a decision input, either public (refForm: 'public') or opaque as a commitment (refForm: 'commitment'). Opacity is not confidentiality on its own. See AI Execution CER.

    executionRole

    A required, producer-declared field on a V2 snapshot: 'advisory' | 'operative' | 'unspecified'. NexArt never infers this value. See AI Execution CER.

    instructionKind

    Required when instruction is present, forbidden otherwise: 'system' | 'derived' | 'label'. See AI Execution CER.

    Integrity vs Authenticity

    Integrity means the artifact was not modified since it was sealed. Authenticity means the artifact can be attributed to a specific signer (for example, via node attestation). A bundle can have integrity without an attached attestation. See AIEF.

    jcs-v1 / nexart-v1

    The two canonicalisation profiles currently supported, each bound to specific protocolVersion values. See Versions.

    modelEvidence

    An optional V2 snapshot field carrying producer-transcribed evidence about a model response. It is never provider-signed proof, and it never overwrites the producer-declared model field. See AI Execution CER.

    Opening

    The { field, salt, scheme } needed to reveal a commitment for selective disclosure. Openings are never stored in the CER; the producer keeps them. See AIEF.

    Producer-First

    The principle that the producer computes and owns certificateHash before any node is involved; the node only attests to what already exists. See AI Execution CER.

    projectHash

    A hash binding the ordered step registry of a Project Bundle. See Versions.

    Project Bundle

    A container (cer.project.bundle.v1) composing multiple CERs (V1, V2, or a mix) into one verifiable, ordered workflow. See AI Execution CER.

    protectedSet

    An SDK-derived list of sorted field paths sealed inside a V2 bundle's certificateHash, never caller-supplied. See AI Execution CER.

    protocolVersion

    The canonicalisation protocol version carried in a snapshot or bundle. An unrecognized value MUST be rejected (fail closed). See Versions.

    Receipt

    The node's signed attestation response for a sealed artifact, added under meta.attestation after sealing. See AI Execution CER.

    RFC 3161 Trusted Timestamp

    A third-party timestamp authority's cryptographic proof that data existed at a given time, used as supplemental timestamp evidence. See Versions.

    Salt

    Random bytes mixed into a commitment's HMAC key to prevent brute-force guessing of low-entropy values. See AIEF.

    Sealing

    The act of computing certificateHash and finalizing a bundle so it becomes independently verifiable. See AI Execution CER.

    Snapshot

    The recorded execution fields inside a CER, before sealing. See AI Execution CER.

    Verdict

    An evaluation outcome. In verification, a success verdict is 'VERIFIED' | 'VERIFIED_CONFIDENTIAL'. In the Policy SDK, a verdict is 'PASS' | 'FAIL' | 'ERROR', with ERROR distinct from FAIL. See Policy SDK.

    Next