Commands / kosa8 evidence export
kosa8 evidence export
Write a signed evidence package for a sandbox, snapshot, approval or time range
Selects the audit entries that name a --sandbox, --snapshot or --approval (any of them), narrowed by --since/--until or --from/--to, or selects a time or sequence range on its own. The package carries every entry from the first selected to the last — the chain cannot be checked across a gap — plus the seals and signed approvals those entries name.
--out ending in .tar writes a tar; anything else, a directory. Signed with
--signer-key (one line of base64 Ed25519, as kosa8 policy keygen writes),
or this machine's own key, which attests "this machine exported it" rather
than a person's signature.
Reads the local state directly, so it works with the daemon stopped.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--ai-bom | bool | include a CycloneDX AI bill of materials for each sandbox, session and model in scope (on by default with --session or --model) | — |
--approval | stringArray | entries about this approval request id, full or 8+ characters (repeatable) | [] |
--from | int64 | only entries from this sequence number | 0 |
--model | stringArray | entries naming this model, by sha256:<digest> or local name (repeatable) | [] |
--no-compliance | bool | leave out the machine's doctor --compliance report | — |
-o, --out | string | package path: .tar for a tar, else a directory (default kosa8-evidence-<time>.tar) | — |
--range | stringArray | entries about this cyber range: its bring-up and every trainee's scores and results (repeatable) | [] |
--sandbox | stringArray | entries about this sandbox (repeatable) | [] |
--session | stringArray | entries of this AI session: its model exchanges and MCP decisions (repeatable) | [] |
--signer | string | printed name of the signer, recorded in the manifest | — |
--signer-key | string | sign with this Ed25519 key file instead of the machine's key | — |
--since | string | only entries at or after this time (RFC 3339, or a date) | — |
--snapshot | stringArray | entries about this snapshot, and its seal (repeatable) | [] |
--to | int64 | only entries up to this sequence number | 0 |
--until | string | only entries at or before this time | — |