The Pack Manifest

Every evidence pack contains evidence_pack.manifest.json. It is the machine-readable index every other artefact in the pack hangs from. The manifest is what gets signed; the signature is what anchors the hash chain. The canonical schema lives at roboticks-sdk/schemas/evidence_pack.manifest.json and is JSON Schema Draft 2020-12.

Top-level shape

{
  "$schema": "https://schemas.roboticks.io/evidence_pack.manifest.json",
  "schema_version": "1.0.0",
  "generator_version": "rbtk-evidence-builder/0.9.4",
  "generated_at": "2026-05-24T14:21:08Z",
  "pack_id": "epak_01HF5ZN3T0AAQ8X6BB1A8M2P3W",
  "release": { "...": "..." },
  "or_commit_set": { "...": "..." },
  "requirements": { "...": "..." },
  "tests": { "...": "..." },
  "mcaps": [ /* ... */ ],
  "coverage": { "...": "..." },
  "sbom": { "...": "..." },
  "static_analysis": [ /* ... */ ],
  "traceability": { "...": "..." },
  "standards": [ /* ... */ ],
  "chain": { "...": "..." },
  "signature": { "...": "..." }
}

The manifest is either release-scoped or commit_set-scoped — exactly one of the two is populated. See Release scoping.

Field-by-field

Top-level fields

Field	Type	Description
`schema_version`	string (semver)	Schema version this manifest conforms to. Builder always emits the latest.
`generator_version`	string	The exact Roboticks builder version that produced the pack. Lets future-you regenerate identically.
`generated_at`	string (RFC 3339)	Build timestamp in UTC.
`pack_id`	string (ULID, `epak_` prefix)	Globally unique pack identifier.

`release` (one of `release` or `commit_set`)

"release": {
  "id": "rel_01HF5J1K9V…",
  "tag": "v1.4.0",
  "title": "May 2026 quarterly release",
  "state": "shipped",
  "verified_at": "2026-05-22T09:11:00Z",
  "shipped_at": "2026-05-24T08:00:00Z",
  "repositories": [
    {
      "url": "https://github.com/acme-robotics/firmware",
      "ref": "v1.4.0",
      "commit_sha": "9b14ab8…"
    }
  ]
}

`commit_set` (alternative to `release`)

"commit_set": {
  "id": "cs_01HF5K7R…",
  "branch": "main",
  "commits": [
    {"repository": "…/firmware", "commit_sha": "9b14ab8…"},
    {"repository": "…/messages", "commit_sha": "31cd02a…"}
  ]
}

`requirements`

"requirements": {
  "snapshot_id": "snap_01HF5JBQ…",
  "total": 247,
  "covered": 244,
  "gaps": 3,
  "acknowledged_gaps": 2,
  "by_type": {"safety": 89, "functional": 142, "performance": 16},
  "by_asil_pl": {"PLa": 12, "PLc": 38, "PLd": 27, "PLe": 12},
  "reqif_path": "requirements/snapshot.reqif",
  "json_path": "requirements/snapshot.json"
}

`tests`

"tests": {
  "total_runs": 1843,
  "passed": 1840,
  "failed": 0,
  "skipped": 3,
  "junit_paths": ["tests/junit/firmware.xml", "…"]
}

`mcaps`

Array of MCAP references — never inlined, always referenced.

{
  "test_run_id": "tr_01HF…",
  "s3_uri": "s3://rbtk-evidence/projects/acme/mcaps/…/run-42.mcap",
  "presigned_url": "https://…",
  "presigned_expires_at": "2026-06-23T14:21:08Z",
  "sha256": "9c1f…",
  "size_bytes": 84238812,
  "storage_class": "STANDARD"
}

storage_class is either STANDARD (hot, freshly readable) or DEEP_ARCHIVE (in Glacier, retrieval required). See Archive.

`coverage`

"coverage": {
  "line_coverage": 0.873,
  "branch_coverage": 0.819,
  "by_language": {"cpp": {"line": 0.84}, "python": {"line": 0.91}},
  "gcov_dir": "coverage/gcov",
  "lcov_html_index": "coverage/lcov/index.html"
}

`sbom`

"sbom": {
  "spdx_path": "sbom/spdx.json",
  "cyclonedx_path": "sbom/cyclonedx.json",
  "component_count": 312,
  "known_cves_at_generation": 0
}

`static_analysis`

Array — one entry per scanner.

{
  "tool": "clang-tidy",
  "tool_version": "18.1.3",
  "sarif_path": "static-analysis/clang-tidy.sarif",
  "findings_by_severity": {"error": 0, "warning": 12, "note": 47}
}

`standards`

For each pinned standard:

{
  "standard_id": "iso-10218-1-2025",
  "title": "ISO 10218-1:2025 Industrial robots — Safety — Part 1",
  "edition": "2025",
  "pinned_at": "2026-01-14T10:00:00Z",
  "derived_requirement_count": 73
}

`chain` and `signature`

These power the tamper-evident hash chain:

"chain": {
  "parent_pack_id": "epak_01HF4ZN…",
  "parent_manifest_sha256": "7a02…",
  "self_manifest_sha256": "9d11…",
  "chain_index": 47
}
"signature": {
  "algorithm": "ed25519",
  "key_id": "arn:aws:kms:eu-west-1:…:key/abc-…",
  "value": "MEQCIB…"
}

The self_manifest_sha256 is computed over the manifest with signature.value stripped, then the signature is computed over self_manifest_sha256. parent_manifest_sha256 is the previous pack’s self_manifest_sha256.

Versioning

The manifest schema is semver. Backwards-compatible additions (new optional fields, new enum values) bump the minor or patch version. Breaking changes (renamed fields, removed fields, changed types) bump the major version and trigger a Roboticks release with explicit migration notes. The builder always emits the latest schema. Older packs are not retroactively rewritten — their schema_version is the version in force at their generation time. CLI tools (rbtk evidence verify-chain, rbtk evidence inspect) handle every shipped major version.

Validating a manifest

rbtk evidence inspect epak_01HF5ZN3T0AAQ8X6BB1A8M2P3W
# … or, for an offline pack
rbtk evidence inspect ./evidence-pack-v1.4.0.zip

The command pretty-prints the manifest, runs schema validation, and reports any mismatches between the manifest’s claimed file paths and the actual ZIP contents. Use this when triaging a suspect pack.

Next steps

Verify the hash chain

Cryptographic verification end-to-end.

Archive lifecycle

What storage_class: DEEP_ARCHIVE means in practice.

Quick Start

GitHub App

Requirements

Traceability

Testing

SDK

Self-Hosted Runners

AI Features

CLI

Evidence Packs

Standards Coverage

Compliance Patterns

Integrations

Pricing

Resources

The Pack Manifest

The Pack Manifest

Top-level shape

Field-by-field

Top-level fields

`release` (one of `release` or `commit_set`)

`commit_set` (alternative to `release`)

`requirements`

`tests`

`mcaps`

`coverage`

`sbom`

`static_analysis`

`standards`

`chain` and `signature`

Versioning

Validating a manifest

Next steps

Verify the hash chain

Archive lifecycle

​The Pack Manifest

​Top-level shape

​Field-by-field

​Top-level fields

​release (one of release or commit_set)

​commit_set (alternative to release)

​requirements

​tests

​mcaps

​coverage

​sbom

​static_analysis

​standards

​chain and signature

​Versioning

​Validating a manifest

​Next steps

Verify the hash chain

Archive lifecycle

The Pack Manifest

Top-level shape

Field-by-field

Top-level fields

`release` (one of `release` or `commit_set`)

`commit_set` (alternative to `release`)

`requirements`

`tests`

`mcaps`

`coverage`

`sbom`

`static_analysis`

`standards`

`chain` and `signature`

Versioning

Validating a manifest

Next steps