Campaign Evidence Pack
Sign the WHOLE campaign — not just one number — and let a CISO verify it offline.
A scorecard pack signs one readiness number. AgentSmack's campaign evidence pack signs the richest artifact the platform produces: a full multi-surface campaign run — the unified scorecard, the coverage map, every compound attack chain, the compound-exposure verdict, the campaign chokepoint, and the attack-surface coverage map — bound into one content-addressed, Ed25519-signed bundle. Download it and a CISO, auditor, or CI gate verifies it offline with zero round-trip. Any edit to the scorecard, coverage, or a fired chain trips a tamper verdict via the content-addressed cp_ packId; a key swap trips a key-mismatch verdict. The pack carries no raw transcript / secret / canary bytes — the campaign result is already redacted to surface + score + hard-blocker + static narrative. Pure, deterministic, migration-free. Three samples below: a clean run, a regressed run capped to not-ready, and a tampered copy that fails verification.
Clean run — verifies
Signed campaign evidence pack
Production ready · 100/100A signed, offline-verifiable evidence artifact over this WHOLE campaign run — the unified scorecard + coverage + compound attack chains + exposure + chokepoint + the attack-surface coverage map. Download the bundle + signature + public key and a CISO, auditor, or CI gate can verify it offline with zero {AgentSmack} round-trip.
- Pack id
- cp_6e830adc60a979247042c9e2
- Driver
- Offline recorded-run campaign
- Surfaces graded
- 1
- Hard blockers
- 0
- Label
- clean-sample
- Signing public key
- 64c30815ff26d5c4aff8e11274a38ed6dd0553049da4c10372a9575b7a776909
Verify offline: paste verifyCampaignPack({ bundleJson, signatureHex, publicKeyHex }) (or POST /api/v1/campaign-pack/verify) with the bundle + signature + public key. Any edit to the scorecard, coverage, or a fired chain trips a tamper verdict via the content-addressed packId + the Ed25519 signature, and a key swap trips a key-mismatch verdict. A valid signature alone does not prove authenticity — confirm the signing public key against your trusted channel before trusting the pack.
Regressed run — capped to not-ready by two hard blockers, still verifies (the failure is the evidence)
Signed campaign evidence pack
Not ready · 39/100A signed, offline-verifiable evidence artifact over this WHOLE campaign run — the unified scorecard + coverage + compound attack chains + exposure + chokepoint + the attack-surface coverage map. Download the bundle + signature + public key and a CISO, auditor, or CI gate can verify it offline with zero {AgentSmack} round-trip.
- Pack id
- cp_32ee4f1ca4bf0e5c8eb81d06
- Driver
- Offline recorded-run campaign
- Surfaces graded
- 2
- Hard blockers
- 2
- Label
- regressed-sample
- Signing public key
- 4508a07aa941707f3eb2db94c8897a80b2c1197476b6de213ac273df7d86c4ff
Verify offline: paste verifyCampaignPack({ bundleJson, signatureHex, publicKeyHex }) (or POST /api/v1/campaign-pack/verify) with the bundle + signature + public key. Any edit to the scorecard, coverage, or a fired chain trips a tamper verdict via the content-addressed packId + the Ed25519 signature, and a key swap trips a key-mismatch verdict. A valid signature alone does not prove authenticity — confirm the signing public key against your trusted channel before trusting the pack.
Tampered copy — a flipped body byte → tamper_detected on verify
Signed campaign evidence pack
Production ready · 100/100A signed, offline-verifiable evidence artifact over this WHOLE campaign run — the unified scorecard + coverage + compound attack chains + exposure + chokepoint + the attack-surface coverage map. Download the bundle + signature + public key and a CISO, auditor, or CI gate can verify it offline with zero {AgentSmack} round-trip.
- Pack id
- cp_6e830adc60a979247042c9e2
- Driver
- Offline recorded-run campaign
- Surfaces graded
- 1
- Hard blockers
- 0
- Label
- tampered-sample
- Signing public key
- 64c30815ff26d5c4aff8e11274a38ed6dd0553049da4c10372a9575b7a776909
Verify offline: paste verifyCampaignPack({ bundleJson, signatureHex, publicKeyHex }) (or POST /api/v1/campaign-pack/verify) with the bundle + signature + public key. Any edit to the scorecard, coverage, or a fired chain trips a tamper verdict via the content-addressed packId + the Ed25519 signature, and a key swap trips a key-mismatch verdict. A valid signature alone does not prove authenticity — confirm the signing public key against your trusted channel before trusting the pack.
Build your own from a real run: opt into emitCampaignPack on the live / offline campaign, or POST a campaign result to /api/v1/campaign-pack and verify it at /api/v1/campaign-pack/verify.