# kosa8 evidence export

Write a signed evidence package for a sandbox, snapshot, approval or time range

Selects the audit entries that name a --sandbox, --snapshot or --approval (any
of them), narrowed by --since/--until or --from/--to, or selects a time or
sequence range on its own. The package carries every entry from the first
selected to the last — the chain cannot be checked across a gap — plus the
seals and signed approvals those entries name.

--out ending in .tar writes a tar; anything else, a directory. Signed with
--signer-key (one line of base64 Ed25519, as `kosa8 policy keygen` writes),
or this machine's own key, which attests "this machine exported it" rather
than a person's signature.

Reads the local state directly, so it works with the daemon stopped.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--ai-bom` | bool | include a CycloneDX AI bill of materials for each sandbox, session and model in scope (on by default with --session or --model) |  |
| `--approval` | stringArray | entries about this approval request id, full or 8+ characters (repeatable) | `[]` |
| `--from` | int64 | only entries from this sequence number | `0` |
| `--model` | stringArray | entries naming this model, by sha256:<digest> or local name (repeatable) | `[]` |
| `--no-compliance` | bool | leave out the machine's doctor --compliance report |  |
| `--out, -o` | string | package path: .tar for a tar, else a directory (default kosa8-evidence-<time>.tar) |  |
| `--range` | stringArray | entries about this cyber range: its bring-up and every trainee's scores and results (repeatable) | `[]` |
| `--sandbox` | stringArray | entries about this sandbox (repeatable) | `[]` |
| `--session` | stringArray | entries of this AI session: its model exchanges and MCP decisions (repeatable) | `[]` |
| `--signer` | string | printed name of the signer, recorded in the manifest |  |
| `--signer-key` | string | sign with this Ed25519 key file instead of the machine's key |  |
| `--since` | string | only entries at or after this time (RFC 3339, or a date) |  |
| `--snapshot` | stringArray | entries about this snapshot, and its seal (repeatable) | `[]` |
| `--to` | int64 | only entries up to this sequence number | `0` |
| `--until` | string | only entries at or before this time |  |

---
Source: https://docs.kosa8.com/reference/evidence-export/