Skip to content

The evidence format

.gmk — evidence that outlives its software.

A Genomarker evidence package is a single portable file. It carries the analysis, its provenance, its environment, its findings, and its signatures — and verifies offline, without the Genomarker application, indefinitely.

Package layout

Package tree
GM-2026-08-14-8F29E1.gmk/
├── ro-crate-metadata.json
├── analysis-spec.json
├── assurance-profile.json
├── assurance-findings.json
├── assurance-statement.json
├── provenance/   sap/   inputs/
├── execution/    environment/
├── determinism/  preservation/
├── results/      methods/
├── replay/
│   └── replay-attestation.json
└── signatures/

Verify transcript
$ genomarker verify GM-2026-08-14-8F29E1.gmk
structure   VALID
signatures  AUTHENTIC · ed25519
artifacts   UNCHANGED · all hashes match

Object schemas

  • evidence_bundle/1The portable container — a .gmk package holding every object below, RO-Crate self-describing.
  • assurance_statement/1The signed, precise claim: dimensions, profile version, scope — the document a reviewer reads.
  • assurance_findings/1Every rule evaluated, with explanation, remediation, and numerical fixtures. Machine-readable.
  • execution_record/1What actually ran: environment digest, implementation versions, seeds, actor provenance.
  • preservation_manifest/1Every replay dependency, classified — embedded, archived, content-addressed, or externally referenced.
  • replay_attestation/1A signed account of an independent re-execution and its equivalence classification.

Design guarantees

  1. Content-addressed

    Every artifact is named by its hash. Tampering is not hidden — it is detectable by arithmetic.

  2. Signed end to end

    Statements, findings, attestations, and the bundle itself carry ed25519 signatures; keys rotate, history verifies.

  3. Self-describing

    RO-Crate metadata means a 2036 reader with no documentation can still navigate the package.

  4. Offline-verifiable

    Verification requires the open verifier and the file. No account, no API, no company required to exist.

Judge the format by its contents.

The assurance model explains what the objects claim; the corpus audit shows them produced against real published science.