dev.cocore.compute.exchangeAttestation

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "key": "tid",
      "record": {
        "properties": {
          "auditPosture": {
            "description": "Human-readable note about how the exchange is run (e.g. 'single-tenant on Railway, no third-party access, source on github.com/cocore/services'). Out-of-band trust signal.",
            "maxLength": 256,
            "type": "string"
          },
          "createdAt": {
            "format": "datetime",
            "type": "string"
          },
          "exchange": {
            "description": "Exchange DID. MUST equal the repo this record is published in.",
            "format": "did",
            "type": "string"
          },
          "policy": {
            "description": "Strong-ref to the dev.cocore.compute.exchangePolicy this attestation covers.",
            "ref": "com.atproto.repo.strongRef",
            "type": "ref"
          },
          "signingKeyFingerprint": {
            "description": "Fingerprint of the public key the exchange signs settlements with. Should match the verificationMethod publicKeyMultibase in the exchange's did document.",
            "maxLength": 128,
            "type": "string"
          },
          "softwareVersion": {
            "description": "Identifier for the exchange-side software running. Free-form; e.g. 'cocore-services@v0.3.2 (commit a1b2c3d)'. Lets verifiers match settlements to a specific build.",
            "maxLength": 64,
            "type": "string"
          }
        },
        "required": [
          "exchange",
          "policy",
          "softwareVersion",
          "signingKeyFingerprint",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "description": "An exchange's self-published statement of operating posture: software commit, public signing key fingerprint, fee policy in effect, audit posture. The provider/requester analog of `dev.cocore.compute.attestation` for the exchange role. Settlements MAY strong-ref the active attestation so verifiers can pin which exchange-software / signing-key combination produced the record.",
  "id": "dev.cocore.compute.exchangeAttestation",
  "lexicon": 1
}