b5 / 11

Making it portable

Seams ① Record to ④ Result. Build: an evidence file a stranger's verifier checks offline. Conform to: draft-mih-zhang-agent-disclosure-bundle-00 and the conformance vectors.

Evidence is portable when the format is an open spec with vectors, the code is libraries any host can link by version, and the saved file can be checked offline by a verifier that never talks to the host, an account or an operator.

1What it is

Portability is a layering rule: open specs and vectors at the bottom, libraries that pass those vectors above them, and the host-specific plugin on top, depending on the libraries by version.

What leaves the host is one file in an open format, holding the records, their signatures, a signed checkpoint and an inclusion proof for each record.

Any verifier that implements the spec checks that file offline from the file and the signer's key alone, so the evidence still checks if the host, its operator or the plugin's author goes away.

2Design choices

Chosen: the plugin links the sealing, log and check code as published crates, named by version; those crates are developed and tested in their own repositories.

Rejected: copying the library code into the plugin. (capsules README.md “Repository layout” and crates/evidence-plugin/Cargo.toml @ v0.1.4)

Chosen: the evidence-request crate is pinned exactly (=0.0.3), because “a new release may change what verifies”.

Rejected: a caret range for a crate whose new release can change a verification result. (capsules crates/evidence-plugin/Cargo.toml @ v0.1.4, comment on capsule-emit-evidence-request)

Chosen: the spec's vectors are copied into the plugin unchanged, pinned to a spec tag and its commit, listed in SHA256SUMS, and run in the plugin's tests.

Rejected: vectors generated by the implementation under test. (capsules vectors/SOURCES.md; tests/aac_canonical_vectors.rs @ v0.1.4)

Chosen: no default witness. A checkpoint is registered only with a service the operator names, and each witness is dialled at the URL given.

Rejected: a built-in service every node reports to, which would make one operator part of every check. (capsules docs/VERIFICATION-CHAIN.md Link 7; Cargo.toml comment on capsule-emit 0.0.6 @ v0.1.4)

Chosen: the evidence file is checked “offline, from the file alone. No profile and no network are used.”

Rejected: checking by asking the producer's node or a hosted service, which needs the producer to still exist. (draft-mih-zhang-agent-disclosure-bundle-00; capsule-cli README.md, verify --bundle)

Proposed (open PR): when the plugin moves into the host's own repository, the host's plugin API becomes a path dependency, and the evidence libraries stay versioned registry crates.

Rejected: git dependencies or [patch] overrides. (Mesh-LLM/mesh-llm#2459, open: “no [patch] and no git dependencies”)

3What it shows / what it does not

Shows

From an evidence file alone: each record's identity (its capsule_id recomputes), its producer signature, the signed checkpoint, and each record's inclusion under that checkpoint.
That the sealing crate computes the same capsule_id as the spec's reference for every canonical-* vector at the pinned tag.
Exactly which library release the plugin was built against: Cargo.lock records the version and its registry checksum.
That no verifier step depends on the host, the plugin's author or a hosted service still existing.

Does not show

Who holds the signing key in the real world: the key is node-generated and self-attested (capsules docs/VERIFICATION-CHAIN.md Link 3).
That an answer was right, or that every event was logged.
Anything from the capsules plugin's own saved files today: v0.1.4 writes mesh-ledger-exchanges-evidence/1, mesh-ledger-integrity-evidence/1 and mesh-ledger-peers-evidence/1, schemas no verifier reads.
Outside time: with no witness named, nothing outside the node saw the checkpoint.
Full coverage for the two live-run evidence-file vectors on every verifier version: records, signatures, closure and checkpoint pass, while coverage and membership depend on the agent-action-capsule version (capsule-emit test-vectors/evidence-file/README.md).
That two hosts write byte-identical records: only that both follow the same format and pass the same vectors.

4Example

The plugin's library dependencies as its manifest names them at v0.1.4 (comments and the non-evidence dependencies trimmed). The “Resolved” column is what Cargo.lock at the same tag records.

[dependencies]
mesh-llm-plugin = "0.78"
…
capsule-emit-lib = { package = "capsule-emit", version = "0.0.6" }
cll = { package = "checkpointed-local-log", version = "0.2.1" }
…
capsule-emit-evidence-request = "=0.0.3"
…
scitt-cose-receipt = { git = "https://github.com/action-state-group/scitt-cose", rev = "8833281c11d33e3c1e289cf74f11d25ee7f3c6dc" }

Name	Type	Meaning
mesh-llm-plugin	"0.78"	The host's plugin API: the only host-specific library. Resolved 0.78.0 from crates.io.
capsule-emit	"0.0.6"	Seals every record, keeps the ledger and checkpoints, verifies offline; renamed `capsule-emit-lib` because the plugin has its own `capsule_emit` module. Resolved 0.0.6 from crates.io.
checkpointed-local-log	"0.2.1"	The local Merkle log; checks a pushed bundle's inclusion proof. Resolved 0.2.1 from crates.io.
capsule-emit-evidence-request	"=0.0.3"	Parses evidence requests, signs refusals, builds answers; pinned exactly. Resolved 0.0.3 from crates.io.
scitt-cose-receipt	git rev	Checks a witness's receipt offline. Not on crates.io at v0.1.4, so pinned to a public commit; `Cargo.lock` records the commit, not a registry checksum. On crates.io since 2026-10-15 (0.1.1).

In the open move into the host's repository (#2459, head c645c9638d0f7f61f5d004f9a79137f9aae2d715), mesh-llm-plugin becomes a path dependency, capsule-emit-evidence-request moves to =0.0.4, and scitt-cose-receipt becomes the registry crate "0.1".

Source: Mesh-LLM/capsules:crates/evidence-plugin/Cargo.toml and Cargo.lock @ b4e24453f572b2d9fe8f2cefbd0f35a5eb54b0ad (tag v0.1.4)

5Status

Item	Status	Evidence
Spec vectors	live	agent-action-capsule `vectors/` @ `2ef8aeb49e2334e24c404bd62d3fdb161770873c`; the plugin pins `vectors/capsule/` at tag v0.6.0 (`13a1f4534c31369e927db73af6298e8b9ffdc36a`), capsules `vectors/SOURCES.md` @ v0.1.4.
Libraries on crates.io	live	capsule-emit 0.0.6, checkpointed-local-log 0.2.1, capsule-emit-evidence-request 0.0.3: registry source and checksum in capsules `Cargo.lock` @ `b4e24453f572b2d9fe8f2cefbd0f35a5eb54b0ad`. Their repositories have moved on (capsule-emit `rust/capsule-emit/Cargo.toml` reads 0.0.8 @ `d51a934ebf9d3efa3c86e7f27aaafe2bc06ac05d`); the plugin has not. scitt-cose-receipt reached crates.io on 2026-10-15 (0.1.1), after v0.1.4.
Host plugin, by version	live	Mesh-LLM/capsules release v0.1.4 (published 2026-10-12, three platform packages + `SHA256SUMS`), tag `b4e24453f572b2d9fe8f2cefbd0f35a5eb54b0ad`.
Plugin moving into the host repo	planned	mesh-llm#2459 open, changes requested; stacked on #2449 (open, changes requested); carries #2474's catalog rows until #2474 (open) merges. Not merged: upstream `Mesh-LLM/mesh-llm` main @ `60697c61755b7280c22d3ab9d9bcf5b663e8ae3b` has no `mesh/crates/mesh-llm-capsules-plugin/`.
Open evidence file verified offline (Python)	live	`capsule-emit verify --bundle`: capsule-emit `python/capsule_emit/cli.py` in release `python/v0.11.0` = `d51a934ebf9d3efa3c86e7f27aaafe2bc06ac05d` (capsule-emit 0.11.0).
Open evidence file verified offline (Go)	built-not-live (pre-release)	`capsulectl verify --bundle`: in pre-release `v0.1.0-rc16` (tag object `f92be6497efdfb606437d3679a53bc75b0104101`, published 2026-10-14); capsule-cli `README.md` @ `551b5c616641d15089eb0aac747f5c90aa29bf69`.
Offline report page (not a verifier)	built-not-live	capsule-viewer `README.md` “Evidence report page” @ `32e32e9bd1341edcbcf3af3b073a72e801a928f2` (on main): drawn from capsule-emit's `check_evidence_file`; it never checks.
Plugin writes the open file	designed	Not built, and no design document for it in the capsules repository (no mention of `evidence-bundle` @ v0.1.4 or `efcada74026a2e18b9e62d77432888a31bbe9de4`): `web-ui/src/features/capsules/lib/exchange-export.ts` writes `mesh-ledger-exchanges-evidence/1` and `mesh-ledger-integrity-evidence/1` (and `peer-export.ts` `mesh-ledger-peers-evidence/1`) at v0.1.4; the exchanges schema is unchanged at #2459's head; no repository on main reads these schemas.
Swapping the host	designed	The principle the layers are built for. No second host was checked writing a file the same verifiers accept.

6Specs

Internet-Draft draft-mih-scitt-agent-action-capsule-05 — the record format, and the vectors that pin it.
Internet-Draft draft-mih-zhang-agent-disclosure-bundle-00 — the evidence file (evidence-bundle/v2).
Internet-Draft draft-mih-scitt-checkpointed-local-log-02 — the signed checkpoint and the inclusion and consistency proofs the file carries.
Internet-Draft draft-mih-agent-evidence-request-00 — the protocol the pinned evidence-request crate implements.
RFC RFC 9052 — COSE: the COSE_Sign1 on records and checkpoints.
RFC RFC 8785 — JSON Canonicalization Scheme: the bytes every capsule_id covers.
RFC RFC 9943 — SCITT architecture: a witness the operator may name.
RFC RFC 9942 — COSE Receipts: what a witness returns, checked offline.
Code agent-action-capsule — drafts and conformance vectors.
Code capsule-emit · checkpointed-local-log · scitt-cose — the libraries.
Code capsule-cli · capsule-viewer — capsule-cli is a verifier; capsule-viewer draws an offline report page from capsule-emit's check. Both read the file offline.
Code Mesh-LLM/capsules v0.1.4 — the worked example's host plugin.

7What you need before the next step

Your sealing, log and check code published as libraries, and your host plugin naming them by version, with an exact pin wherever a new release could change what verifies.
The spec's vectors copied in unchanged, pinned to a tag, and run in your tests.
An export that writes the open evidence-file format, not a schema of your own, checked by at least one verifier you did not write.
No default service in the path: a witness only when the operator names one, and a verifier that needs nothing but the file and the signer's key.
A clear split between what the host must provide and what the libraries provide, so the same layers can be laid on a different host: next, a personal agent.