Your first assertion

If other services need a yes-or-no answer from records your institution holds, start by seeing what Registry Evidence gives them. You run it over a synthetic source, ask whether one test person is an adult, and read "value": true from a verified response with no birth date.

Outcome: A verified adult-status assertion, with the source and Registry Evidence left running.
Time: About 15 minutes, plus the first image download
Level: Local development with synthetic data
Prerequisites: Running DockerPython 3, tar, and jqThe tools required by the release verification procedureFree loopback ports 8081, 8082, and 18080

Install Registry Stack

Download one exact rstack-vX.Y.Z-install.sh and the verification material from the same Registry Stack release. Follow the release verification procedure before running the installer. From the verified release directory, install the evidence component:

tag="vX.Y.Z"
bash "rstack-${tag}-install.sh" evidence
rstack evidence --version

The managed installation exposes rstack on your PATH. The evidence component supplies the Registry Evidence runtime and its command-line tools from the same release.

Get the example project

Download the Evidence example projects into a fresh working directory as evidence-examples.tar.gz, then unpack the standalone project into a directory of its own, because the next commands write keys and responses into it:

mkdir first-evidence-assertion
tar -xzf evidence-examples.tar.gz -C first-evidence-assertion standalone
mv first-evidence-assertion/standalone first-evidence-assertion/adult-status
cd first-evidence-assertion/adult-status

Generate disposable owner-only keys and secrets:

umask 077
rstack evidence keygen signing --output-dir .generated/secrets
rstack evidence keygen secret --output .generated/secrets/audit-hmac-key
rstack evidence keygen secret --output .generated/secrets/subject-binding-hmac-key
rstack evidence keygen token --output .generated/secrets/synthetic-source-token

Check and explain the project

rstack evidence check . --target local-target.yaml

Evidence project check: complete
Project: .
Target: local-target.yaml
0 errors, 0 warnings in 1 file

check compiled evidence.yaml against local-target.yaml, which holds the local ports, keys, and source address. Ask what the project answers:

rstack evidence explain . --target local-target.yaml

Definition adult-status: urn:example:requirement:adult-status:v1
  Acquisition: Source person-record
    Source person-record: pack synthetic-register@1; route person; connection synthetic-register
      Posture: record-transformed
      Projection: projections/person-facts.rhai::project_facts; schema schemas/person-facts.json; digest sha256:e203f7570ea7e625e36fa155bf0b4060865b26043b8ba1dce6bcc606fca01696
      Inputs: recordId <- selector subject@record-by-id.record-id
      Facts: birth-date (string), residence-region (string)
  Derive: Function derive-adult-status
  Outputs: adult

adult-status is an assertion definition: one fixed question, named by its Requirement URI. It reads the source person-record and may return one output, the Boolean adult. The report goes on to three other definitions. The source section names the reviewed Adapter pack and route that fetch the record, the governed projection and schema that reduce it to private facts, and the request selector field bound to its input. The report prints fact names and types, without the underlying source values.

Run the fixture cases offline:

rstack evidence test . --target local-target.yaml

PASS: fixtures/adult-status.yaml (10 cases)

rstack evidence access client add tutorial-client \
  --access-profile standalone-service \
  --generate-local-key

Added client tutorial-client with access profile standalone-service.

Start the synthetic source

In a second terminal, in the same directory, start the source that stands in for your system:

python3 serve-source.py \
  --port 8081 \
  --token-file .generated/secrets/synthetic-source-token

It serves records only to the token local-target.yaml gives Evidence. Leave it running.

Start Registry Evidence

Port 18080 avoids a clash with any service on the default 8080. dev start also runs a token issuer in Docker; the first start pulls its image.

rstack evidence dev start . \
  --target local-target.yaml \
  --evidence-port 18080 \
  --issuer-port 8082

Evidence ready at http://127.0.0.1:18080
Issuer ready at http://127.0.0.1:8082

If a port is in use, stop what holds it and start again.

Prepare, send, and verify one request

request prepare gets a token from the issuer and sends nothing to Registry Evidence. It fixes what a valid answer must match before any response exists.

rstack evidence request prepare adult-status \
  --client tutorial-client \
  --purpose age-check \
  --subject subject:record-id=adult \
  --name adult-status

Prepared request: .evidence/requests/adult-status/request.json
Prepared verification context: .evidence/requests/adult-status/verification.json
Prepared authorization: .evidence/requests/adult-status/authorization.curl

Send the prepared JSON as tutorial-client. The API command obtains a fresh token in memory, uses POST because --input is present, and writes the signed response to the named file.

rstack evidence api /v1/evidence \
  --client tutorial-client \
  --input .evidence/requests/adult-status/request.json \
  --accept application/jose+json \
  --output adult-status.jws.json

Verify the response offline against what request prepare fixed:

rstack evidence verify adult-status.jws.json \
  --context .evidence/requests/adult-status/verification.json \
  --output adult-status.verified.json

VERIFIED

On failure verify writes nothing and exits non-zero. Read the answer:

jq '{supportsRequirement, supportedValues}' adult-status.verified.json

{
  "supportsRequirement": "urn:example:requirement:adult-status:v1",
  "supportedValues": [
    {
      "providesValueFor": "urn:example:concept:adult-status:v1",
      "value": true
    }
  ]
}

This assertion answers the Requirement URI with one value for the adult output’s concept. The source holds a birth date for record adult; the assertion carries only true.

Leave it running

The next tutorial continues with this project, with the source and Registry Evidence still running, so leave both as they are. When you are finished with them, run rstack evidence dev stop . and then rstack evidence dev clean . in this directory, and press Ctrl+C in the source’s terminal.

Return a governed value