Evidence Pack
Export a one-folder audit handoff: the Proof Certificate JSON plus its Ed25519 signed envelope, a snapshot of the proof ledger with evidence seals, and standalone verifiers a recipient can run offline with only Node.js.
What the pack contains
Evidence Pack writes one folder for a reviewer, auditor, or diligence recipient. The source exporter writes these files from the current workbook state:
| Artifact | Purpose |
|---|---|
{base}.mxcert.json | The master Proof Certificate JSON, including its SHA-256 integrity self-hash and limitations section. |
{base}.mxcert.signed | An Ed25519 signed envelope over the certificate JSON. It embeds the public key and can be verified without Excel. |
{base}.mxproof | A proof-ledger snapshot: hash chain plus any Ed25519 evidence seals. |
{base}.mxchecks | Included when present: Model Sentinel check state, including adopted checks and any checks declared by the user. |
verify-cert.js | Standalone certificate-envelope verifier. |
verify-ledger-seal.js | Standalone verifier for the ledger hash chain and evidence seals. |
verify-replay.js | Standalone verifier for Replay Proof envelopes you provide separately. |
extract-subtree.js | Standalone helper for extracting a relevant ledger subtree. |
*.js.txt twins | Byte-identical fallback copies of every verifier for environments that strip loose .js files. |
README.md | Contents, commands, fallback instructions, and the honesty boundary. |
Replay Proof envelopes are separate
Evidence Pack does not auto-collect historical Replay Proof artifacts. Replay exports can live anywhere and stale paths would misstate coverage. If you also hand over .mxreplay.signed files, the pack includes verify-replay.js so the recipient can verify them separately.
Sentinel checks stay labelled
When a .mxchecks file contains declared checks, the pack README names them as user-declared checks, not the model's own checks. Adopted checks and declared checks travel in the same sidecar, but the wording keeps their origins separate.
How a recipient verifies it
The scripts use Node.js only; there is no npm install, no Excel dependency, and no ModelxcelPro add-in requirement. From the pack folder, a recipient runs:
node verify-cert.js "Model.mxcert.signed"
node verify-ledger-seal.js "Model.mxproof"If security software removed the .js files, run the byte-identical fallback copies directly:
node verify-cert.js.txt "Model.mxcert.signed"
node verify-ledger-seal.js.txt "Model.mxproof"Honesty boundary
- Signing identity is self-asserted. The key fingerprint identifies the key, not a verified person or organization; confirm the fingerprint with the sender out of band.
- The signed envelope is for the Certificate JSON export. PDF and branded Excel certificate formats remain SHA-256 self-hash only.
- If certificate-envelope signing fails, the exporter still writes the bare JSON, ledger snapshot, verifiers, and README, and surfaces a warning.
- A ledger evidence seal covers records up to sealing time. Records appended later are covered by the hash chain only until the next seal.
- Timestamping, organization identity binding, and revocation are not part of this shipped verifier story yet.
Related commands
- Certificate - the certificate JSON and signed envelope.
- Verify & coverage - Verify Ledger and evidence-seal checks.
- Replay Proof - signed output-movement envelopes you can verify separately.
- File types - every artifact and where it lives.