Cadora · design spec

The evidence pack, by its surfaces

Everything needed to render or extend the proof pack — the exact tokens, the verify verdict's anatomy, what the pack contains, the checksums line format, and every verdict state. The rendered components are live HTML; edit them here or lift the specs into Figma.

Palette

Semantic first · green proves, red warns, amber asks for a second look

Green--scr-green · #16c784Verified · hashes OK · VALID

Red--scr-red · #fb7185Tampered · mismatch · INVALID

Amber--scr-amber · #ffd08aUnsigned · confirm fingerprint

Blue--scr-blue · #6ba5f0Paths · directories

Ink--scr-bg · #0f172aCard ground

Canvas--scr-canvas · #111c2fInset · state cards

Panel--scr-panel2 · #162237Raised surface

Line--scr-line · #334158Borders

Text--scr-text · #f5f7fbPrimary · run id · path

Muted--scr-muted · #9aa8bcLabels · captions

Type & metrics

Monospace is the instrument voice — the pack is read at the shell

Role	Family	Size / weight	Notes
Verdict line	mono	12.5px / 400	The three lines of `cadora verify`
Bottom line	mono	12.5px / 700	`=> VERIFIED` green · `=> NOT VERIFIED` red
Hash	mono	green	64 hex chars; truncate with `…` only in dense views
Path	mono	text	Relative to the run dir — the cwd for `shasum -c`
Fingerprint	mono	amber	`SHA256:` + base64; amber until confirmed out of band

Metric	Value	Metric	Value
Card radius	10px	Semantic accent	4px left border
Verdict line-height	1.85	Tree line-height	1.85
Card padding	14px 16px	State padding	11px 13px
Checksums separator	two spaces	Signature namespace	cadora-evidence

Anatomy — the verify verdict

The one component a recipient reads to trust the pack

1234evidence pack pr1-verify: ✓ hashes 23 file(s) OK ✓ signature VALID — yves@cadora.dev · self-attested confirm signer key SHA256:u4yCok…HJJx8 out of band => VERIFIED

1Pack identity — the run id being verified. One pack, one run.

2Hash floor — every archived file plus report.json, recomputed. N file(s) OK in green, or MISMATCH: <paths> in red. Always runs, signed or not.

3Signature line — VALID / INVALID / none, the signer identity, and the trust basis (self-attested, or an allowed-signers file). Amber flags the fingerprint to confirm out of band.

4Bottom line — => VERIFIED (green, exit 0) only when the hashes hold and any signature checks out; otherwise => NOT VERIFIED (red, exit 1).

Verified · hashes hold, signature checks out

evidence pack pr1-verify: ✓ hashes 23 file(s) OK ✓ signature VALID — yves@cadora.dev => VERIFIED

Tampered · one hash no longer matches

evidence pack pr1-verify: ✗ hashes MISMATCH: design/aidlc-docs/audit.md signature none (checksummed, not signed) => NOT VERIFIED

Green and red are the same component with one token swapped — the left accent and the marks (✓ / ✗). A single mismatch turns the whole verdict red; there is no partial pass.

Pack contents

What cadora report writes, and what cadora sign adds

runs/pr1-verify/ ├── manifest.json # the run's spine — nodes, gates, usage ├── requirements/ # per-node dir │ ├── output.txt │ ├── integrity.json │ ├── human-review.md │ └── aidlc-docs/ … ├── design/ # per-node dir │ └── … └── report/ # the pack — excluded from its own checksums ├── report.html # human view, self-contained ├── report.json # the same evidence, structured ├── checksums.txt # sha-256 of every file above + report.json ├── checksums.txt.sig # detached SSH signature (cadora sign) └── signature.json # signer identity + public key + fingerprint

The report/ directory is skipped when its own checksums are computed, so the pack never tries to hash itself. The two amber files appear only after signing — an unsigned pack is the same tree without them.

The checksums.txt line

One line per file — the format shasum -c reads

5172112d9749df7211e5b70711830af7d0f4d63d6ea698c73cd5903142d3b410 design/aidlc-docs/aidlc-state.md

<64-hex sha-256> · two spaces (highlighted) · <path relative to the run dir>. The two-space separator is exactly what shasum -a 256 -c and sha256sum -c expect, so the same file verifies by hand with no Cadora installed. The last line always hashes report.json.

States

Every verdict the pack can produce

Verified

evidence pack pr1-verify: ✓ hashes 23 file(s) OK ✓ signature VALID — yves@cadora.dev => VERIFIED

Hash mismatch · tampered

evidence pack pr1-verify: ✗ hashes MISMATCH: design/aidlc-docs/audit.md => NOT VERIFIED

Unsigned · checksummed only

evidence pack pr1-verify: ✓ hashes 23 file(s) OK signature none (checksummed, not signed) => VERIFIED

Signature invalid

evidence pack pr1-verify: ✓ hashes 23 file(s) OK ✗ signature INVALID — signature did not verify => NOT VERIFIED

Unsigned still verifies. The hash floor is always-on and independent of the signature: a pack that was never signed is tamper-evident (green verdict) but not attributable — the amber signature line says so. Signing only ever adds a claim; it never weakens the hash check.

What each command produces

Three verbs · report seals, sign attributes, verify judges

Command	Writes	Effect
cadora report <run>	report.html · report.json · checksums.txt	Seals the pack. Tamper-evident, not yet signed.
cadora sign <run> --key	checksums.txt.sig · signature.json	Adds a detached SSH signature. Now attributable. Builds the pack first if it isn't there.
cadora verify <run>	— (reads only)	Recomputes every hash, then checks any signature. Prints the verdict; exit 0 verified, 1 not.

Line	Verified (green)	Failed / warned
hashes	N file(s) OK	MISMATCH: <paths> · <path> (missing)
signature	VALID — <signer> · <trust>	INVALID — <reason> · none (checksummed, not signed)
bottom line	=> VERIFIED	=> NOT VERIFIED

Voice

The verdict is evidence, not applause

Do	Not
State the count — 23 file(s) OK	“All good”
Name the trust basis — self-attested — confirm … out of band	“Trusted ✓”
Show the fingerprint — SHA256:u4yCok…	Hide who signed it
Keep the exact glyphs — => VERIFIED / => NOT VERIFIED	“Success!” / “Failed”

Tokens and behavior are taken verbatim from cadora/report.py and cadora/signing.py. Edit the rendered components in place, or hand the palette and metrics tables to a Figma library.

Design specification for Cadora's evidence pack: the color and type tokens, the anatomy of the verify verdict, the pack contents tree, the checksums.txt line format, the four verdict states (verified, hash-mismatch, unsigned, signature-invalid), and the voice.