Signed evidence artifacts are the proposed Studio wedge

Agencies often need to hand a client something more durable than a screenshot of a scanner dashboard. The proposed Studio wedge for Verglos is a portable evidence summary whose integrity a recipient can check.

This is a design direction. verglos attest is unavailable in 2.0.0-alpha.1; there is no launched Studio plan, public verification service, or published price.

What a signed artifact could establish

A signature can show that an artifact was produced by a particular key and has not changed since signing. It cannot prove that the underlying application is secure, that the scan covered unsupported behavior, or that the signed claims were interpreted correctly.

The artifact should therefore carry its own limits. A reasonable schema would include project and commit identifiers, scanner version, scan time, configuration fingerprint, finding counts, unresolved exceptions, and a link to the applicable methodology. Sensitive finding text and source paths should remain local unless the user explicitly includes them.

What the service would need

Key management: documented signing keys, rotation, compromise response, and historical verification.

Schema stability: versioned payloads and deterministic serialization so the same bytes can be verified later.

Privacy controls: clear fields, explicit publication, retention rules, and deletion behavior.

Revocation: a way to mark an artifact superseded or invalid without pretending the original signature disappeared.

Precise language: “integrity verified” must never become “application certified.”

Why this could be a paid surface

Local scanning can be valuable without an account. Hosted verification introduces durable storage, key operations, identity, access controls, and support obligations. Those are coherent reasons for a paid service if the service is eventually built.

The commercial hypothesis is that agencies will pay for a trustworthy handoff workflow, not for the right to see their own critical findings. The next step is not to announce that hypothesis as a plan. It is to validate the artifact model, privacy boundary, and buyer workflow before pricing it.