Every Dynamo session already generates the artifacts a dispute needs: EIP-712 vouchers signed by scoped session keys, JWS allowance credentials, signed oracle attestations, settlement records with chain/PSP references, refund and break-point records, holdback declarations. The evidence export assembles them into one portable bundle that verifies offline — schema evidence/1.0.0, versioned from birth.
Verification re-checks every signature and every content digest with zero network access and zero trust in the exporter: voucher signatures recover to the session keys the budget registered, credentials and attestations verify against the signer material inside the bundle, the manifest's digests match the content, and the Σ proofs (Σ child settlements ≤ funded ceiling; explicit fee rows; finality per unit range) are re-derived from the bundle's own records — not read from its summary. A tampered byte anywhere returns a named FAIL identifying the broken element.
The rendering (Markdown/HTML) states what was signed, delivered, settled, and refunded, with references — suitable for a card-network representment or a counterparty dispute. It never opines: objective facts only.
Evidence export runs against your instance's session databases and is an operator action at launch: request an export for a budget id and you receive the evidence/1.0.0 JSON bundle. Verification is yours to run, anywhere, offline — the verification material rides inside the bundle, so you are never trusting the exporter (us included). A client-side verifier ships with the evidence tooling; wire-surface export lands on the owner-api per the versioning promise (rule 18, additive minor bump).
The building blocks the bundle is made of are all client-visible today: every tick returns its voucherSeq, signed consume receipts bind a requestRef to billed units, and allowance credentials verify offline against your budget's pinned engineSigner.
| Section | Contents |
|---|---|
session | The full reconciled session view: budget, streams, per-stream settled totals, refunds, fee rows, holdback states, finality, and the settlement-layer records with backend references (chain transactions, PSP intent/capture/transfer/refund ids) |
artifacts.vouchers | Every EIP-712 voucher with its signature and signing domain |
artifacts.credentials / artifacts.attestations | The compact JWS artifacts (allowance credentials, oracle attestations) collected at issuance |
voucherDomain / engineSigner | The verification anchors, digest-pinned by the manifest |
manifest | SHA-256 content digests for every element plus the bundle digest |
The verification demo of record exports a real card-sandbox session, verifies it on a network-disabled process, then flips ONE byte and shows the fail-closed verdict naming the broken element — with the bundle digest and PSP intent ids printed for dashboard cross-check. Ask for it in a sales or diligence conversation; it runs in minutes.
The bundle schema is evidence/1.0.0 and follows the same interface discipline as every public artifact: additive changes bump the minor version with a CHANGELOG entry; a breaking change without a deprecation note is forbidden. A bundle you export today verifies forever — verification material rides inside the bundle, not in any repository.