Evidence bundles

evidence.zip is the portable evidence package for a receipt. The bundle can be downloaded, archived and checked without access to the ProofRails database.

Core files

The exact file set depends on the receipt path. A completed hosted x402 receipt inspected on 29 July 2026 contained:

delivery.json
manifest.json
manifest.sig
pain001.xml
public_key.pem
receipt.json
tip.json

Other receipt paths can add applicable artifacts. Clients must read manifest.json rather than assume that a named file is always present. A verifiable credential is optional; the presence of vc.json must not be assumed.

Manifest

The manifest records each covered file's name, SHA-256 hash and byte size. Verification fails if a file is missing, its bytes change, or its declared size does not match.

Signature

manifest.sig is an Ed25519 signature over the canonical manifest bytes. public_key.pem contains the public key required to verify that signature.

The signature proves that the holder of the corresponding private key signed the manifest. It does not, by itself, establish who controlled the key or whether the source data was accurate.

Bundle hash

ProofRails calculates SHA-256 over the final ZIP bytes and stores it as a 0x-prefixed bundle hash. EvidenceAnchor commits that 32-byte value on Flare.

Do not calculate the anchor value from an extracted directory or from manifest.json. The committed value is the SHA-256 of the served evidence.zip for the current receipt.

Resource hash

delivery.json can carry the SHA-256 of delivered content or a protected API response. Verify it against the original bytes separately from the ZIP hash. The resource hash binds delivery bytes; the bundle hash binds the complete evidence package.