What a Bridge report carries
An external engine runs its own pipeline and emits
vouch.bridge-report/v0. The report binds
- exact source and target bytes by hash and byte length
- engine name, version, and commit
- the declared execution route and capability identifiers
- declared gate results as
pass,fail, ornot-run - hashes of linked proof or gate artifacts
- an
attestsandexcludesboundary that records the observation supplied by the engine and the responsibilities it retains
This format lets an engine publish inspectable evidence while keeping its implementation private.
Verify a report
Run the external engine, preserve the source and target bytes, and pass the report and named artifacts to Lispex.
lispex verify-bridge \
--source source.lspx \
--target translated.output \
bridge-report.jsonAdd --linked <artifact-id>=<artifact-file> to bind a linked artifact. Add
--expect-context <manifest.json> to select the expected profile, subject, and
route through vouch.bridge-context-manifest/v0.
Exit 0 returns vouch.bridge-verify-report/v0 with successful structure,
byte, boundary, and requested-context checks. Exit 1 returns a verification
report with the failed check. Exit 2 identifies usage, input/output, or JSON
parsing errors.
Artifact roles
| Product | Role |
|---|---|
| External engine | Creates the target and runs its declared gates |
| Bridge report | Binds that run to exact artifacts, identities, and results |
lispex verify-bridge | Validates report structure and receiver-selected bindings |
| Recipient policy | Decides which external engine, route, and evidence to accept |
Bridge reports and native differential receipts remain distinct artifact
classes. vouch.bridge-report/v0 enters lispex verify-bridge, while
csk.differential-receipt/v0 records reference-interpreter agreement and
enters lispex verify.
Keep going
The Vouch overview connects authentication, request binding, current execution agreement, and a local grant.