opschain governance evidence attest
packs:security-governance
opschain governance evidence attest --control <id|key> --verdict verified|verified_with_exceptions|failed [--evidence <kind>:<ref>]... [--notes <text>]
Appends a control attestation to the evidence ledger
(GovernanceService.AppendAttestation). Evidence citations are typed
references — a digest or id, never a copy: kinds are artifact (a
sha256: blob digest), audit_event, campaign, export (a manifest
hash), waiver, external. An audit_event citation is validated at
append time: the cited id must name a stored event (list candidates with
opschain events, inspect one with opschain events show <id>), and an
unknown id is refused naming it. The ledger outlives the events it cites,
so a citation whose event later ages out of retention stays a verbatim
reference. Needs updatable on /governance/evidence,
the pack entitlement, and a stepped-up session — an unelevated call is
refused with the CLI elevation hint.
-o json / -o yaml emit the appended ledger row.
Flags
| Flag | Meaning |
|---|---|
--control <id|key> | The attested control (mandatory). |
--verdict <verdict> | verified, verified_with_exceptions or failed (mandatory). |
--evidence <kind>:<ref> | A typed evidence citation (repeatable; the ref keeps any further colons). |
--notes <text> | Notes recorded on the attestation. |
Exit codes
| Code | Meaning |
|---|---|
| 0 | Appended; the row's seq and hash are reported. |
| 1 | Refused — the surface, pack or step-up refusal, or an unknown control/kind (named by the server). |
| 2 | Usage error, including missing mandatory flags, a malformed --evidence, or a missing server target. |