AIIR Commit Receipt Predicate — v1

This URI identifies the AIIR commit receipt predicate type for use in in-toto Statement v1 attestation envelopes.

in-toto Statement Envelope

When the --in-toto flag is used, AIIR wraps each receipt in a standard in-toto Statement v1:

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "https://github.com/example/repo@abc123...",
      "digest": { "gitCommit": "abc123..." }
    }
  ],
  "predicateType": "https://invariantsystems.io/predicates/aiir/commit_receipt/v1",
  "predicate": {
    "type": "aiir.commit_receipt",
    "schema": "aiir/commit_receipt.v1",
    ...
  }
}

Verification

The predicate (inner receipt) is verified using the AIIR verification algorithm (SPEC.md §9). The in-toto envelope is verified by standard supply-chain tools:

• Sigstore cosign
• Kyverno
• OPA / Gatekeeper
• Tekton Chains

Subject Format

The subject identifies the git commit:

Implementations