Proof URL v0 (static proof pack)

Proof URL v0 is a deterministic static proof renderer:

(bundle[, decision]) -> proof/

It is offline by design (no Hub services, no auth, no server). The output is a shareable proof folder (and optionally a deterministic zip) that any reviewer can open locally and verify independently.

Render a proof pack

From a bundle directory (or a .zip/.hxs bundle):

helix hub proof render \
  --bundle fixtures/hub_example_bundle_v1 \
  --out proof_dir \
  --zip

Output layout:

proof_dir/
  index.html
  proof_manifest_v1.json
  verifier.txt
  assets/style.css
  bundle/...
  decision.json        (only if provided/loaded)

Notes:

No timestamps, no random IDs, stable ordering. Same inputs produce byte-identical outputs.
The renderer prints a proof manifest digest (sha256 of proof_manifest_v1.json) so the proof pack itself is content-addressed.
The example bundle includes an application/octet-stream artifact (blobs/sample.bin) specifically to demonstrate a true sha256 mismatch integrity failure without relying on JSON parse/canonicalization semantics.

Verify the proof (offline)

The proof page includes the exact verifier command it expects you to run. From inside the proof directory:

cd proof_dir
helix hub verify bundle ./bundle --require-signatures

Expected output shape:

manifest: sha256:...
core: sha256:...
OK

Do not trust the page; trust the verifier output.

Render from a Decision (local store)

If you have a local Decision stored under var/hub/decisions/by_id/<decision_id>.json, you can render a proof pack from the Decision ID:

helix hub proof render \
  --decision-id DECISION123 \
  --out proof_dir

Bundle resolution rule (local-only):

If --bundle is not provided, Helix expects a bundle directory at:
- var/hub/bundles/<bundle_digest_hex>/
- where bundle_digest_hex is the decision’s approved_bundle_digest (or proposed_bundle_digest) without the sha256: prefix.
Override this location with helix hub proof --bundle-root <path> render ....