An in-toto predicate type.

capability/v1

A signed statement that a named tool read these Velaris source files, byte for byte, and reports this capability surface: the effects the program declares, the paths, hosts and modules it names, and the narrowest budget to run it under.

Predicate type: https://velaris-lang.dev/capability/v1 - this page.

Also read as this type: https://gowrishankar-infra.github.io/velaris-lang/capability/v1, the name Statements written by velaris-lang 4.2 to 8.2.1 carry; that address redirects here.

Schema: schema.json, JSON Schema draft 2020-12, for the predicate. Definition: velaris-spec SPEC.md section 8.5, dedicated to the public domain under CC0.

What it is #

A velaris.audit/1 document (velaris-spec section 8) names no file and carries no signature. This predicate type puts one inside an in-toto Statement v1, whose subjects are the files audited, identified by digest, so that a signed Statement says which source the audit describes, and who says so.

JSON

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {"name": "examples/effects.vel",
     "digest": {"sha256": "e483365ce74a20770a1ef503f185f4de2c16b0524797408784a235e78b6baafb"}}
  ],
  "predicateType": "https://velaris-lang.dev/capability/v1",
  "predicate": {
    "producer": {"name": "velaris-lang",
                 "uri": "https://github.com/gowrishankar-infra/velaris-lang"},
    "specification": "velaris-spec 0.13.0",
    "auditedAt": "2026-09-11T00:00:00Z",
    "audit": {"schema": "velaris.audit/1", "velaris_version": "8.5.0",
              "ok": true, "effects": ["clock", "fs", "io", "rand"],
              "safe_command": "velaris <file> --allow clock,fs:read:report.txt,fs:write:report.txt,io,rand",
              "counts": {"fs": 2, "net": 0}, "prover": true,
              "...": "the rest of the audit"}
  }
}

Fields #

Field	Required	Meaning
`subject[0]`	yes	the file audited: `name`, its path as the producer was given it, `/`-separated; `digest.sha256` of its bytes. The files it imports should follow, one subject each.
`predicate.audit`	yes	a `velaris.audit/1` document produced from exactly the bytes the subjects name
`predicate.producer`	yes	`name` of the implementation that wrote the audit, and optionally `uri`; its version is the audit's `velaris_version`
`predicate.specification`	no	the velaris-spec version followed, as `velaris-spec 0.13.0`
`predicate.auditedAt`	no	when the audit was made, RFC 3339 in UTC, by the producer's clock
`predicate.conformance`	no	the conformance levels the producer claims (velaris-spec CONFORMANCE.md) and the corpus it ran - a claim, not evidence

Parsing rules #

In-toto's standard parsing rules apply. Ignore any field you do not know, in the predicate and in the audit. Fields may be added within v1; a change of meaning is a new type, .../capability/v2. Check that the first subject's digest is the digest of the file you mean to trust.

What it does not say #

That the audit is right, that the program is safe to run, or that any runtime will enforce the budget in safe_command. When audit.ok is false, it says nothing about what the program may do. It says that the signer ran the producer on these bytes and got this audit.

A producer #

velaris-lang writes Statements of this type, from 4.2:

Shell

velaris attest program.vel --output program.intoto.json

It signs none; cosign (cosign attest-blob --statement) and sigstore-python sign them, as EMBEDDING.md shows. Every release of velaris-lang carries one for an example program, signed by its release workflow and verified there; velaris-spec's example was written by velaris attest.