Verdict for CAGE.
Evidence held outside the kernel.

The Cybernetic Agent Governance Engine (Apache-2.0, hosted in the Google GitHub organisation, not an official Google product) governs agents at the point of inference and delegates legal baselines, FRIA validation and evidence sealing to an external NormativeProvider. Verdict implements that three-endpoint seam as provider_08.

1. Three environment variables

CAGE_NORMATIVE_PROVIDER=provider_08
CAGE_NORMATIVE_ENDPOINT=https://verdict.systems/api/cage
CAGE_NORMATIVE_API_KEY_SECRET=<key issued by Verdict>

Keys are issued per deployment; email evidence@verdict.systems with the CAGE region you run. The baseline endpoint and the discovery document at /api/cage need no key. Until a key is configured on both sides the keyed endpoints answer 503, never 200.

2. The three endpoints

• GET /api/cage/legal-baseline/{region}

  Normative Data Supply. Returns the regional control-mapping profile (US_FED, EU_ECB, APAC_MAS) under a strong ETag equal to the SHA-256 of its canonical JSON, so CAGE's six-hourly refresh detects change without re-downloading. Public read.

• POST /api/cage/validate/fria

  External Validation, synchronous gate. Takes CAGE's action_context unchanged and answers ALLOW, REFUSE or ESCALATE with OSCAL-vocabulary findings. Verdict checks record-completeness under the baseline's record-keeping and oversight controls; it does not adjudicate the substance of the action and says so in every response.

• GET|POST /api/cage/evidence-chain/{thread_id}

  Attestation Logging. Seals CAGE's evidence hash into a Sealed Evidence Record held by Verdict and anchors the record commitment to the Sigstore Rekor transparency log. The commitment is returned as seal_hash, with a verify URL anyone can open.

3. Verify it yourself

curl -s https://verdict.systems/api/cage | jq .
curl -sI https://verdict.systems/api/cage/legal-baseline/EU_ECB | grep -i etag

The ETag is the SHA-256 of the sorted-key canonical profile, the same digest CAGE computes as profile_hash. The profiles are copied unmodified from CAGE's config/compliance/ at a pinned commit and carry that commit in _upstream_commit.

Public sandbox tier: an ephemeral ECDSA P-256 signer per request, Sigstore Rekor anchoring, no retention. Production tenants attach retention policy, custodian identity and a hardware-backed signer. The adapter, its tests and the partner specification live in the CAGE repository under src/integrations/provider_08/ once the upstream pull request lands.