Attestation format
The threshold-signed, expiring envelope every alert, rating and incident is delivered in. Verifying one needs our public key and nothing else.
Why an attestation rather than a message
A webhook body proves nothing after the fact. An attestation is verifiable by a third party, whether your auditor, your underwriter or a counterparty, without our cooperation and without our continued existence. That last part is the point: the artefact outlives the vendor.
Threshold-signed
k-of-n over independent Ed25519 keypairs, so no single signature can issue one, and every attestation stamps the signer-set mode it was produced under. Keys are held in software, not an HSM: the threshold protects against a forged or replayed signature, not against compromise of the signing secret itself. We do not claim HSM custody until it exists.
Mandatory expiry
Every attestation carries one. An alert that cannot go stale is an alert that can be replayed against a contract months later, so expiry is a field the verifier enforces rather than a convention the issuer follows.
What a contract does with it
Nothing, unless you decide it should. The GuardianModule you deploy verifies the signature and the expiry and then applies YOUR policy. Fuga Labs signs; your contract decides.
Where the boundary sits.
In the same type as everything above it, and paired with the control that covers it. This is the part your auditor reads first.
Put Attestation format on your perimeter.
Engine-level detail and the full catalogue are provisioned with your engagement, alongside the console your team works in.