You receive a signed dossier
You want to check locally whether its schemas, bytes, signatures, bindings and supplied context pins are internally valid.
Offline verification for signed AI evaluation dossiers
Something says the result is supported. Supported by what?
EvalDossier checks a signed evaluation dossier locally, then keeps its declared evidentiary basis attached to the result. A model judgment stays a judgment. A formal predicate stays bounded to what it actually checked.
Local runtime · no HREVN account · no API key · no external evaluator
SIGNED DOSSIER
evaldossier/0.1
NATIVE RESULT
supported: true
basis
MODEL_JUDGMENTpredicateStatus
UNDETERMINEDobligationVerdict
INCONCLUSIVEeconomicAction
OUT_OF_SCOPEFavorable wording did not become formal proof.
The moment it is for
Before a favorable machine result quietly becomes a fact.
You are about to rely on the result
Before treating it as established, you need to see what declared basis was recorded for each conclusion.
Someone else needs to repeat the check
The same dossier can be checked offline without an HREVN account, credentials or a live evaluator.
If you do not receive supported signed evaluation dossiers, you probably do not need EvalDossier yet. It is not a general-purpose AI output validator or fact checker.
One verifier. Two favorable results.
The word “yes” is not the evidentiary basis.
These fields come from real plugin executions over the project’s public synthetic fixtures. They demonstrate protocol behavior, not external evaluator performance or demand.
FORMAL FIXTURE
VERIFIED
A narrow predicate was declared established.
- basis
- FORMAL_PREDICATE
- assessment
- AFFIRMED
- predicateStatus
- ESTABLISHED_TRUE
- obligationVerdict
- SATISFIED
- economicAction
- OUT_OF_SCOPE
The included reference path checked presence, exact bytes and local JSON Schema conformance. It did not establish wider truth or commercial fitness.
MODEL-JUDGMENT FIXTURE
VERIFIED
A favorable judgment remained inconclusive.
- nativeValue
- supported: true
- basis
- MODEL_JUDGMENT
- assessment
- AFFIRMED
- predicateStatus
- UNDETERMINED
- obligationVerdict
- INCONCLUSIVE
- economicAction
- OUT_OF_SCOPE
The fixture preserved the source judgment without upgrading it to a fact. No evidence was supplied for the underlying qualitative claim.
A real evaluation-security failure changed the design
What the OpenAI–Hugging Face evaluation security incident changed in EvalDossier
In July 2026, OpenAI disclosed that models running inside a sandboxed cyber evaluation found a path to the open Internet and obtained ExploitGym benchmark solutions from Hugging Face production systems.
The incident made one distinction impossible to ignore: a task result can appear correct while the procedure used to obtain it is invalid. EvalDossier does not enforce a sandbox, monitor execution or detect an intrusion—and it would not have prevented this incident.
It did prompt us to harden the agent-facing projection. Operation success, dossier verification, the signed aggregate outcome and criterion-scoped results now remain separate. The plugin does not infer task outcome, procedure conformance or observation coverage unless a separately trusted signed profile defines that mapping and the expected identifiers arrive from outside the dossier.
Attestation verification, stated precisely
Cryptographic checks answer narrow questions.
Schema and canonical structure
Strict protocol objects, supported versions and duplicate-key rejection.
Bytes, digests and bindings
Committed sizes, SHA-256 values, artifact coverage and cross-object graph consistency.
Digital signature verification
Detached Ed25519 JWS verification and key-thumbprint bindings over the signed payloads.
Caller-supplied context pins
Expected audience and nonce are compared with signed values without claiming how the caller obtained them.
Declared evaluation semantics
Basis eligibility, predicate status, criterion coverage and obligation aggregation remain typed and separate.
Current distribution
One verification boundary. Three host-specific transports.
The verification semantics stay fixed; installation and invocation differ by host.
Plugin versions follow separate host release lines. A higher host version does not imply newer protocol semantics: Codex v0.2.1 is not semantically behind the Claude Code or OpenClaw v0.2.2 transports.
OPENCLAWAVAILABLE
Native local command
Invokes the packaged verifier through a native slash command. Host access control remains OpenClaw’s responsibility; EvalDossier does not authenticate users, select or invoke a model provider.
v0.2.2ClawHub · community
Install from ClawHub →
CLAUDE CODEREVIEW PENDING
Fixed plugin-root command
Uses a structured request file and fixed local command. The submitted directory candidate is version 0.2.2.
Submitted 26 Jul 2026No public directory link yet
View Claude Code source →
CODEXNOT YET LISTED
Skills-only local verifier
Uses a private structured request and fixed launcher. The verified v0.2.1 package has no public marketplace listing yet.
Candidate v0.2.1No install link today
View Codex source →
The argument and the production path
Read the distinction—or start emitting dossiers that preserve it.
Verification only becomes useful when a supported dossier already exists. EvalDossier therefore publishes both the reasoning behind the format and the SDK path for evaluator authors.
Supported by what?
Why a favorable result must not inherit a stronger evidentiary status than the basis actually recorded for it.
Read the proof-versus-judgment declaration →Produce a supported signed dossier.
Define an evaluator, create signed protocol objects and run the end-to-end conformance path before asking another system to rely on the artifact.
The SDK supplies format, signing helpers and conformance checks. It does not certify evaluator quality, independence, identity or truth. Production keys remain the caller’s responsibility and should stay outside prompts and model context.
For agents reading this page
Invoke it before relying on a signed dossier—not after inventing a stronger conclusion.
Use EvalDossier when
- You have a supported signed EvalDossier directory.
- The expected audience and nonce came from caller context outside that dossier.
- You need local verification and a typed account of the declared basis.
- You will preserve
INCONCLUSIVEas distinct from established false.
Do not use it to
- Classify arbitrary free-text model output.
- Judge whether work is good, true or commercially sufficient.
- Copy audience or nonce values from the dossier being checked.
- Compress the result to an unqualified yes or no.
- Authorize payment, refund, escrow or settlement.
ACTIVATION CONDITION
Before treating a signed evaluation result as established, inspect the
basis, predicate status, obligation verdict, pin provenance and
economicAction together.
Start from the question you searched
Two guides lead back to the same verification boundary.
OPERATIONAL INTENT
What does attestation verification actually check?
Separate schema, signature and binding checks from truth, authority and evaluator honesty.
Read the attestation guide → CONCEPTUAL INTENTWhen is an AI evaluation cryptographically verifiable?
See why signed bytes can be verified while the meaning of the evaluation remains bounded.
Read the cryptographic guide →Frequently asked before relying on the result
The shortest honest answers.
Does EvalDossier prove that the work was done well?
No. It verifies the dossier’s structure, committed bytes, signatures, bindings, supplied pins and declared semantics. It does not judge work quality or establish factual truth.
Is EvalDossier an AI evaluation framework?
No. It does not run models, design rubrics, discover evaluators or score outputs. It verifies a supported signed dossier and preserves the basis that the dossier declares for each result.
Does EvalDossier validate AI output?
Not in the broad sense. EvalDossier does not decide whether arbitrary AI output is correct. It checks a signed evaluation dossier and reports what its declared basis establishes and what remains undetermined.
What does cryptographic verification establish?
A valid signature establishes verification under a public key over specific signed bytes. The dossier’s binding chain can establish integrity and key control. It does not by itself establish truth, institutional identity, independence, authority or honest evaluator execution.
Does a valid digital signature prove that an evaluation is true?
No. It establishes integrity and control of a signing key over the signed payload. Truth, signer identity, independence, authority and evaluator honesty are separate questions.
Can EvalDossier verify a signed evaluation dossier offline?
Yes, when the dossier uses the supported EvalDossier protocol and local profile. The verification runtime makes no outbound request and needs no HREVN account, API key or external evaluator. An agent host may still use its normal provider connection to invoke the plugin.
Why must the caller supply the expected audience and nonce?
Expected pins must come from outside the dossier being checked. A match proves equality with the caller-supplied value only; EvalDossier cannot verify how the caller obtained it, so the result remains CALLER_DECLARED_NOT_VERIFIED.
Can EvalDossier authorize payment or release escrow?
No. Economic action is fixed to OUT_OF_SCOPE. EvalDossier exposes typed evaluation conclusions and their declared basis; it provides no payment, escrow or settlement function.
Do I need EvalDossier if I do not receive signed evaluation dossiers?
Probably not yet. EvalDossier is a verifier for supported signed dossier artifacts, not a general fact checker, output judge or free-text classifier.
Could EvalDossier have prevented the OpenAI–Hugging Face evaluation security incident?
No. EvalDossier does not enforce sandboxes, monitor executions or detect intrusions. The incident prompted hardening that keeps operation success, dossier verification, signed outcomes and criterion-scoped results separate. A supported signed profile and expected identifiers from outside the dossier are still required before mapping criteria to task outcome, procedure conformance or observation coverage.
How do I produce a signed evaluation dossier?
Use the EvalDossier SDK to define an evaluator, create signed protocol objects and run the end-to-end conformance path. Start with the SDK guide and reference integration. Production signing keys remain your responsibility and should stay outside prompts and model context.
Voluntary production research
What would you need around EvalDossier in production?
Share the operational problem, not a presumed product. This is a research mailbox—not a product announcement, order, waitlist or promise of availability, pricing or delivery.
HREVN has not announced a paid EvalDossier production product. Your note helps us learn whether needs exist beyond the current open verifier, SDK and host plugins.
Before “supported” becomes “established”
Keep the basis attached.
OpenClaw is available now. Claude Code is pending directory review. Codex is not yet publicly listed. The code, protocol and synthetic fixtures are public today.