nexart.iodocs

    CAGE-Compatible Governed Execution

    Integrate a CAGE governance producer with NexArt: verified baseline, routes, accepted and rejected graph cases, and how to verify Node evidence independently.

    NexArt Node0.30.1@nexart/governed-execution0.4.2

    CAGE emits a provider_02 AttestationBundle. NexArt seals it as cer.governed.execution.v1 under the cage-governance-v1 profile. CAGE is described here as a reference producer. The NexArt package is not endorsed by, sponsored by or affiliated with Google or CAGE.

    Verified interoperability baseline

    ItemValue
    Node0.30.1
    Governed SDK0.4.2
    Authenticated submissionPOST /api/attest
    Stateless verificationPOST /v1/cer/verify
    Key discoveryGET /.well-known/nexart-node.json
    Cyclic static topologyAccepted
    Acyclic concrete lineageRequired
    HITL parent subsetAccepted
    Omitted-node ancestor contractionAccepted
    Illegal concrete edgeRejected: TOPOLOGY_ERROR / ILLEGAL_EXECUTED_EDGE
    Dangling parent referenceRejected: CAUSAL_ERROR
    Malformed stateHashRejected: SCHEMA_ERROR

    Validation layers for a successful CER

    certificateIntegrity: valid
cageSchemaValidity:   valid
causalGraphValidity:  valid
topologyValidation:   valid | not-supplied
resourceSafety:       valid

    Independent verification by the producer

    1. Recompute the certificate hash using RFC 8785 JCS and SHA-256.
    2. Verify the receipt signature over canonical JCS(receipt), the whole receipt.
    3. Verify the verification-envelope signature over the canonical { attestation, bundle } projection, using your own expected whitelist.
    4. Select the signing key by receipt.attestorKeyId from GET /.well-known/nexart-node.json.

    Runtime interoperability evidence

    Production interoperability validation reported by the CAGE project: 19/19 over-the-wire checks passed against NexArt Node 0.30.1 and @nexart/governed-execution 0.4.2.

    • This confirms observed interoperability.
    • It does not prove deployed Git commit provenance.
    • It is not a general security audit.
    • It does not prove automatic public discoverability.

    The request and response contract is documented separately from the inspected release source in the Governed Attestation Contract.

    Boundaries

    • stateHash is an opaque producer commitment; NexArt does not receive the private AgentState preimage.
    • signals.governanceSignature is not interpreted as a provider signature. Producer authentication is not claimed.
    • Attestation does not publish the record. Default visibility is hidden and there is no governed public-reseal workflow.

    See Topology and Concrete Lineage and Errors and Troubleshooting.