FortProof evidence, version 1

https://fortproof.dev/attestation/evidence/v1 identifies a FortProof evidence manifest. The identifier is permanent: it is written into every manifest the shipped security pipelines produce, and into the attestations that sign them.

• Where it appears: the predicate_type field of evidence-manifest.json, and the predicate type of the attestation the GitHub pipelines create for that manifest (actions/attest, predicate-type).
• Schema: evidence-manifest.schema.json (schema_version 1.0). A manifest names the repository, commit and run that produced it, the tool and its result, and the SHA-256 of every output file.
• How it is used: the platform accepts a manifest only from an approved workflow at an approved commit, checks the file hashes and binding, and verifies the attestation where one exists. See the evidence model.

A future incompatible format gets a new identifier (…/v2); this one does not change.