Code Mode Certification

Step 1, Build CER Bundle

Render your code through the CLI. The output includes a CER bundle JSON file (out.snapshot.json) that binds your code, seed, VARs, and rendered output together with SHA-256 hashes.

# Render and generate CER bundle JSON
npx --yes @nexart/cli@1.2.0 run ./examples/sketch.js \
  --seed 12345 \
  --vars "50,50,50,0,0,0,0,0,0,0" \
  --include-code \
  --out out.png

# Verify CER bundle integrity locally
npx --yes @nexart/cli@1.2.0 verify out.snapshot.json
# Output: [nexart] Result: PASS

The CER bundle JSON (out.snapshot.json) contains the certificateHash, a SHA-256 digest over the canonical JSON of the bundle's core fields. Any modification to the code, seed, parameters, or output invalidates this hash.

Step 2, Attest to Node

Submit the sealed CER bundle JSON to a canonical attestation node. The node verifies internal hash consistency and returns a signed receipt proving the bundle was recorded in the proof ledger.

# Attest the CER bundle JSON to the canonical node
npx --yes @nexart/cli@1.2.0 attest out.snapshot.json \
  --nodeUrl https://nexart-canonical-renderer-production.up.railway.app \
  --apiKey $NEXART_API_KEY

Expected output fields:

{
  "attestationId": "att-abc123...",
  "signature": "<Ed25519 signature, base64url>",
  "kid": "<attestorKeyId from node's .well-known/nexart-node.json>"
}

Important: Attestation verifies the bundle's hashes and returns a signed receipt. It does not re-run your code, re-render the output, or alter the recorded CER bundle in any way.

Step 3, Store Bundle + Proof

Persist the full CER bundle JSON along with the signed receipt. This gives you a complete audit trail: the sealed execution record plus third-party proof of integrity.

// The CER bundle JSON contains everything needed for offline verification:
// - snapshot (codeHash, seed, VARs, renderHash, protocolVersion)
// - certificateHash (integrity seal)
// - receipt + signature + attestorKeyId (node attestation proof)

// Store to your database or archive
await db.insert('cer_bundles', {
  certificate_hash: bundle.certificateHash,
  cer_bundle_redacted: redact(bundle),
  attestation_json: proof,
});

What Gets Stored vs. What Can Be Redacted

Redaction rule: Delete keys or set them to null. Never set to undefined, it is not valid JSON and will break canonical serialization.

Reason Codes

When you or an auditor verifies a Code Mode CER bundle, the result includes a machine-readable reason code:

Try It