Skip to content

Guided tour

FabrCore 2.0 · Release and package availability

These guides track the current 2.0 source. Stable 2.0.0 publication is pending; package commands show the release target. Until it is published, follow the source quick start or use a matching available prerelease set. Release migration · Runtime modes

MODULE 12 · LESSON 12.3

Add verifiable execution progressively

Enable signed execution evidence in progressively stronger environments.

Lesson 70 of 86 · FabrCore 2.0

Overview

Verifiable execution records a chained timeline; signing binds it to a workload identity. SQL selects a durable store but does not enable capture/signing by itself. A local certificate is enough to learn the verification flow; SPIFFE is an advanced optional identity backend.

Capture and signing are separate switches

UseVerifiableExecution enables evidence recording. The local certificate signer adds signatures suitable for learning the integrity workflow. Without a signer, records can be unsigned. SQL can provide durable storage, but it does not enable capture/signing by itself. The example explicitly installs both features for the development exercise.

Verification needs the original records and trust

A bundle records a chained execution timeline with signatures and public identity material. A verifier checks the recorded relationships and trust against the intended policy. A valid signature says the recorded bytes have not been changed under that trust; it does not establish that the model's answer is correct or every uninstrumented action was captured.

Enable local signed evidence

  1. Configure UseVerifiableExecution and a local certificate signer through FabrCoreServerOptions. Do not invent an automatically bound JSON section.
  2. Generate a request, export its bundle and verify the signatures/chain. Keep evidence capture distinct from monitor display.
  3. For production, select a durable store and customer-managed certificate/KMS/HSM or supported SPIFFE/SVID integration with explicit trust material.
Program.cs · enable development capture and signing 
using FabrCore.Host;

var builder = WebApplication.CreateBuilder(args);
builder.AddFabrCoreServer(new FabrCoreServerOptions()
    .UseVerifiableExecution()
    .UseLocalCertificateVerifiableExecutionSigner());
var app = builder.Build();
app.UseFabrCoreServer();
app.Run();

Verify an original and altered bundle

  1. Enable the local signing example, run a small fixture request, and export its evidence bundle through the documented evidence API/tooling. Preserve the original export.
  2. Verify the untouched bundle with the appropriate development trust material and inspect the verification result, including any unsigned/incomplete findings.
  3. Alter a copy of a record and verify the copy. Expect integrity/chain verification to fail. Separately test missing trust so trust failure is distinguishable from data tampering.

The comparison demonstrates what evidence verification actually checks. A local self-signed development identity is not automatically trusted for production or cross-cluster verification.

If the result is different

A valid signature proves integrity of the recorded evidence, not complete capture of every event in the cluster or correctness of the model's answer.

Go deeper

Explore the related documentation.