Verdict for CAGE.
Evidence held outside the kernel.

The Cybernetic Agent Governance Engine (Apache-2.0, hosted in the Google GitHub organisation, not an official Google product) governs agents at the point of inference and delegates legal baselines, FRIA validation and evidence sealing to an external NormativeProvider. Verdict implements that three-endpoint seam. The adapter was merged into CAGE's main branch as provider_08 on 25 September 2026 (pull request #222), and the endpoints it calls are live here.

1. Three environment variables

CAGE_NORMATIVE_PROVIDER=provider_08
CAGE_NORMATIVE_ENDPOINT=https://verdict.systems/api/cage
CAGE_NORMATIVE_API_KEY_SECRET=<key issued by Verdict>

A stock CAGE checkout resolves provider_08 from commit ef4c156 onward, and the factory also accepts the alias verdict. Older checkouts raise Unknown normative provider; pull main first.

Keys are issued per deployment; email evidence@verdict.systems with the CAGE region you run. The baseline endpoint and the discovery document at /api/cage need no key. Until a key is configured on both sides the keyed endpoints answer 503, never 200.

2. The three endpoints

• GET /api/cage/legal-baseline/{region}

  Normative Data Supply. Returns the regional control-mapping profile (US_FED, EU_ECB, APAC_MAS) under a strong ETag equal to the SHA-256 of its canonical JSON, so CAGE's six-hourly refresh detects change without re-downloading. Public read.

• POST /api/cage/validate/fria

  External Validation, synchronous gate. Takes CAGE's action_context unchanged and answers ALLOW, REFUSE or ESCALATE with OSCAL-vocabulary findings. Verdict checks record-completeness under the baseline's record-keeping and oversight controls; it does not adjudicate the substance of the action and says so in every response.

• GET|POST /api/cage/evidence-chain/{thread_id}

  Attestation Logging. Seals CAGE's evidence hash into a Sealed Evidence Record outside CAGE, returns it, and anchors the record commitment to the Sigstore Rekor transparency log. Verdict keeps no copy. The commitment is returned as seal_hash, with a verify URL that carries the whole record.

3. Verify it yourself

curl -s https://verdict.systems/api/cage | jq .
curl -sI https://verdict.systems/api/cage/legal-baseline/EU_ECB | grep -i etag

The ETag is the SHA-256 of the sorted-key canonical profile, the same digest CAGE computes as profile_hash. The profiles are copied unmodified from CAGE's config/compliance/ at a pinned commit and carry that commit in _upstream_commit. Their legal statements are CAGE's, not Verdict's: the EU_ECB profile, for one, calls a hash-chained decision ledger a statutory requirement in a control it maps to Article 12, and the Act names no such ledger.

Public sandbox tier: an ephemeral ECDSA P-256 signer per request, Sigstore Rekor anchoring, no retention. Retention policy, custodian identity and a hardware-backed production signing tier are planned; no production tenant exists yet. The adapter, its tests and the partner specification are in the CAGE repository under src/integrations/provider_08/ and docs/partners/provider_08/, merged in #222, and CAGE's own test suite includes live tests against these endpoints.