Use Lispex Vouch

The six stages

Stage	Command	Result	Owner
1. Describe trust	`vouch policy create`, then `policy check`	canonical policy for reviewed key, engine, profile, and source identities	recipient
2. Issue	`vouch issue --emit-bundle`	Native-signed source, input, profile, and complete transcript context	issuer
3. Authenticate	`vouch verify --bundle ...`	signature and policy match	recipient
4. Bind the request	add `--source-image` or `--source`, plus `--input`	authenticated context matches the separately supplied request	recipient
5. Observe current execution	add `--reexecute`	current Native execution matches the signed complete transcript	Native
6. Require one decision	`vouch gate --require-decision ...`	live authenticated result matches the required decision	host application

The host application supplies caller identity, freshness, replay prevention, business authorization, and the external action.

Prepare exact inputs

Prepare these values independently.

reviewed refund-window.lspx.png or refund-window.lspx
exact checked input file INPUT
Ed25519 public key issuer.spki.der
absolute local PKCS#8 key URI for issuance
reviewed SHA-256 of the exact Native executable
new paths for POLICY, OUTPUT, and each report

Print the exact identities through the shared Rust core.

lispex vouch key-id --public-key issuer.spki.der
lispex vouch engine-id --executable /exact/path/to/lispex
lispex vouch source-id --source-image refund-window.lspx.png
lispex vouch input-id --input INPUT

1. Create recipient policy

lispex vouch policy create \
  --public-key issuer.spki.der \
  --engine-sha256 sha256:<reviewed-engine-digest> \
  --source-image refund-window.lspx.png \
  --out POLICY

lispex vouch policy check --trust-policy POLICY

The policy records the recipient's reviewed key, engine, profile, and source allowlist in canonical bytes.

2. Issue signed evidence

ISSUER_KEY_URI="pkcs8-file:///absolute/path/to/private.pkcs8.der"
lispex vouch issue \
  --source-image refund-window.lspx.png \
  --input INPUT \
  --profile csk.checked-profile/v1 \
  --key-handle "$ISSUER_KEY_URI" \
  --out-dir OUTPUT \
  --emit-bundle

Native executes the rule and signs the exact source, input, profile, engine, result, and complete transcript context. The bundle carries those canonical bytes under its configured byte budget.

3. Authenticate the bundle

lispex vouch verify \
  --bundle OUTPUT/vouch-input-bundle.json \
  --trust-policy POLICY \
  --report-out AUTH-REPORT

The report records signature verification and the exact policy match.

4. Bind the current request

lispex vouch verify \
  --bundle OUTPUT/vouch-input-bundle.json \
  --trust-policy POLICY \
  --source-image refund-window.lspx.png \
  --input INPUT \
  --profile csk.checked-profile/v1 \
  --report-out PINNED-REPORT

The report now binds the authenticated context to the source and input supplied by this invocation.

5. Observe current Native execution

lispex vouch verify \
  --bundle OUTPUT/vouch-input-bundle.json \
  --trust-policy POLICY \
  --source-image refund-window.lspx.png \
  --input INPUT \
  --profile csk.checked-profile/v1 \
  --reexecute \
  --report-out REEXECUTION-REPORT

Native creates a fresh execution observation and compares both complete transcripts.

6. Require the decision

lispex vouch gate \
  --bundle OUTPUT/vouch-input-bundle.json \
  --trust-policy POLICY \
  --source-image refund-window.lspx.png \
  --input INPUT \
  --profile csk.checked-profile/v1 \
  --require-decision approve \
  --report-out GATE-REPORT

Exit 0 records the required live local decision. Exit 10 records a gate refusal. The application consumes that result together with its freshness, replay, identity, and action policy.

Compiled evidence

Native can derive lispex.vouch-compiled-artifact/v1 from the same exact source and add verified Rust VM agreement to the tree and Meaning chain. The compiled workflow re-derives Core IR and bytecode after request authentication.

Keep going

Vouch Receipts · Application Handoff