An in-toto predicate type.

capability/v1

A signed statement that a named tool read these Sabline source files, byte for byte, and reports this capability surface: the effects the program declares, the paths, hosts and modules it names, and the narrowest budget to run it under.

Predicate type: https://sabline.dev/capability/v1 - this page.

Also read as this type: https://velaris-lang.dev/capability/v1, https://gowrishankar-infra.github.io/velaris-lang/capability/v1, the name Statements written by sabline-lang 4.2 to 8.2.1 carry; that address redirects here.

Schema: schema.json, JSON Schema draft 2020-12, for the predicate. Definition: sabline-spec SPEC.md section 8.5, dedicated to the public domain under CC0.

What it is #

A sabline.audit/1 document (sabline-spec section 8) names no file and carries no signature. This predicate type puts one inside an in-toto Statement v1, whose subjects are the files audited, identified by digest, so that a signed Statement says which source the audit describes, and who says so.

JSON

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {"name": "examples/effects.vel",
     "digest": {"sha256": "e483365ce74a20770a1ef503f185f4de2c16b0524797408784a235e78b6baafb"}}
  ],
  "predicateType": "https://sabline.dev/capability/v1",
  "predicate": {
    "producer": {"name": "sabline-lang",
                 "uri": "https://github.com/gowrishankar-infra/sabline-lang"},
    "specification": "sabline-spec 0.13.0",
    "auditedAt": "2026-09-11T00:00:00Z",
    "audit": {"schema": "sabline.audit/1", "sabline_version": "8.6.0",
              "ok": true, "effects": ["clock", "fs", "io", "rand"],
              "safe_command": "sabline <file> --allow clock,fs:read:report.txt,fs:write:report.txt,io,rand",
              "counts": {"fs": 2, "net": 0}, "prover": true,
              "...": "the rest of the audit"}
  }
}

Fields #

Field	Required	Meaning
`subject[0]`	yes	the file audited: `name`, its path as the producer was given it, `/`-separated; `digest.sha256` of its bytes. The files it imports should follow, one subject each.
`predicate.audit`	yes	a `sabline.audit/1` document produced from exactly the bytes the subjects name
`predicate.producer`	yes	`name` of the implementation that wrote the audit, and optionally `uri`; its version is the audit's `sabline_version`
`predicate.specification`	no	the sabline-spec version followed, as `sabline-spec 0.13.0`
`predicate.auditedAt`	no	when the audit was made, RFC 3339 in UTC, by the producer's clock
`predicate.conformance`	no	the conformance levels the producer claims (sabline-spec CONFORMANCE.md) and the corpus it ran - a claim, not evidence

Parsing rules #

In-toto's standard parsing rules apply. Ignore any field you do not know, in the predicate and in the audit. Fields may be added within v1; a change of meaning is a new type, .../capability/v2. Check that the first subject's digest is the digest of the file you mean to trust.

What it does not say #

That the audit is right, that the program is safe to run, or that any runtime will enforce the budget in safe_command. When audit.ok is false, it says nothing about what the program may do. It says that the signer ran the producer on these bytes and got this audit.

A producer #

sabline-lang writes Statements of this type, from 4.2:

Shell

sabline attest program.vel --output program.intoto.json

It signs none; cosign (cosign attest-blob --statement) and sigstore-python sign them, as EMBEDDING.md shows. Every release of sabline-lang carries one for an example program, signed by its release workflow and verified there; sabline-spec's example was written by sabline attest.