Lispex Vouch

When a publisher hands the final file to a printer, Lispex Vouch records the decision that page size, margins, embedded fonts, and page count meet the agreed specifications. If a printing problem occurs, both parties can check the same record. Vouch checks agreement between the record and re-execution. The calling application determines the actual action.

six-step Learning Path.

Four checks, four results

The issuer runs the rule and signs its record. The recipient chooses which keys, executable, and source to accept.

vouch verify authenticates the record. Add --source and --input to bind your request, then --reexecute to check current execution. Use vouch gate --require-decision approve when the application requires approve in that call. The guide supplies complete commands and their results.

Choose trust before checking the signature

Create a trust policy from a public key, an executable identifier, and source you reviewed independently. The policy stores the allowed keys, engines, language profiles, and source identifiers in one prescribed byte format.

The executable identifier is the SHA-256 of the exact Native program. The public key identifies the issuer's signing key. The recipient decides how that key relates to an organization and deployment.

vouch policy create writes this configuration. vouch policy check checks its format. Next, vouch verify uses it to check the signed record. Successful authentication means that an allowed key signed the recorded context. Current execution is checked separately with --reexecute.

What the issuer sends

Native vouch issue runs the rule and signs these facts with an Ed25519 key.

• Exact source and input bytes.
• The language profile csk.checked-profile/v1, which selects the forms accepted by this workflow.
• Both complete execution records, including the final result.
• The identifier of the issuer's exact Native executable.

Native runs the source through two implementations. Lispex Interpreter reads and normalizes the source into core forms (CoreExpr), then evaluates them. The Meaning interpreter evaluates a representation derived from that source. Both are implemented in Rust. The signed record preserves both full execution records, rather than only their final values.

The signature and recorded data form a signed record container, also called the DSSE envelope. With --emit-bundle, issuance also creates a bundle containing the envelope, source, and input. The bundle format has a byte limit. See Records and Reports for the files.

Supply your own request

Pass the source you reviewed through --source and the input you chose through --input. Vouch compares their exact bytes with the signed context. The bundle carries the issuer's choices. these separate files specify yours.

Native re-execution and the gate require both external paths. An incomplete pair is rejected before the files are read. A fully checked Lispex Image can provide the source through --source-image. The image carries source bytes. the recipient still chooses the input and trust policy.

Rerun, then require the result

Native vouch verify --reexecute runs both interpreters now. It compares their complete execution records with the signed records and reports authentication and current execution separately.

vouch gate performs authentication, request binding, re-execution, and the required-decision check within one Native call. A match creates a local grant, a result held inside that process. The application receives the gate result, and the report records what happened during that invocation.

Each gate call performs these checks again from the supplied evidence and request. Saved reports serve inspection and logging. The calling application manages caller identity, freshness, expiry, revocation, request reuse, and transaction state. It authorizes and performs file delivery, printing, and other external actions.

Also require a compiled execution

Add --compiled-artifact when you also need the Lispex VM to agree. A virtual machine runs compiled instructions. Native rebuilds the lispex.vouch-compiled-artifact/v1 file from your exact source after authenticating the request. It checks the derived bytecode and runs the Lispex VM.

This adds VM agreement to the tree and Meaning checks within the same Rust implementation family. The check binds the compiled file, source, input, execution record, and resource limits. The compiled example shows the commands.

Choose another check

Follow the Vouch guide for the final-file handoff example. Use Records and Reports to choose which result file to read next.