┌──────┬─────────────────────────────────────────────────────────────────────────────────────────────────────┐

  │ Task │                                                What                                                 │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 013  │ Created trust-layers.md — canonical three-layer model, terminology glossary, decision flow          │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 014  │ Created a2a-attestation-composition.md — composition guide with Python/Node examples                │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 015  │ Updated README.md — replaced inline boundary text with link to trust-layers                         │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 016  │ Updated a2a.md — added "A2A vs. Attestation" section                                                │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 017  │ Updated attestation.md — added "Attestation vs. A2A Trust Policy" section                           │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 018  │ Updated sign-vs-attest.md — added cross-agent exchange branch (#5) + table row                      │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 019  │ Updated decision-tree.md — added A2A+Attestation row + Stage 3 note                                 │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 020  │ Updated SUMMARY.md — added both new pages                                                           │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 036  │ Added jacs_attest_export_dsse MCP tool — params struct, schema, handler                             │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 037  │ Added jacs attest export-dsse CLI subcommand — reads file, outputs DSSE envelope                    │
  ├──────┼─────────────────────────────────────────────────────────────────────────────────────────────────────┤
  │ 038  │ Fixed all example digests — Python, Node, shell, tutorial (replaced placeholders with real SHA-256) │
  └──────┴─────────────────────────────────────────────────────────────────────────────────────────────────────┘

Author: Hendler

README.md

@@ -12,6 +12,7 @@
  */
 
 const { JacsClient } = require('@hai.ai/jacs/client');
+const { createHash } = require('crypto');
 
 async function main() {
   // 1. Create an ephemeral agent (in-memory keys, no files)
@@ -22,11 +23,12 @@ async function main() {
   console.log(`Signed document: ${signed.documentId}`);
 
   // 3. Attest WHY this document is trustworthy
+  const contentHash = createHash('sha256').update(signed.raw).digest('hex');
   const attestation = await client.createAttestation({
     subject: {
       type: 'artifact',
       id: signed.documentId,
-      digests: { sha256: 'from-signed-doc' },
+      digests: { sha256: contentHash },
     },
     claims: [{ name: 'reviewed_by', value: 'human', confidence: 0.95 }],
   });

docs/jacsbook.pdf

@@ -10,6 +10,7 @@
     python examples/attestation_hello_world.py
 """
 
+import hashlib
 import json
 from jacs.client import JacsClient
 
@@ -21,11 +22,12 @@
 print(f"Signed document: {signed.document_id}")
 
 # 3. Attest WHY this document is trustworthy
+content_hash = hashlib.sha256(signed.raw_json.encode()).hexdigest()
 attestation = client.create_attestation(
     subject={
         "type": "artifact",
         "id": signed.document_id,
-        "digests": {"sha256": "from-signed-doc"},
+        "digests": {"sha256": content_hash},
     },
     claims=[{"name": "reviewed_by", "value": "human", "confidence": 0.95}],
 )

examples/attestation_hello_world.js

@@ -38,10 +38,11 @@ echo "Document signed."
 
 echo ""
 echo "=== 4. Create an attestation ==="
+DOC_HASH=$(sha256sum mydata.json | awk '{print $1}')
 jacs attest create \
   --subject-type artifact \
   --subject-id "mydata-001" \
-  --subject-digest "sha256:from-signed-doc" \
+  --subject-digest "sha256:${DOC_HASH}" \
   --claims '[{"name": "reviewed_by", "value": "human", "confidence": 0.95}]'
 echo "Attestation created."
 

examples/attestation_hello_world.py

@@ -1309,6 +1309,14 @@ pub struct AttestVerifyParams {
     pub full: bool,
 }
 
+/// Parameters for exporting an attestation as a DSSE envelope.
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+pub struct AttestExportDsseParams {
+    /// The signed attestation document JSON string.
+    #[schemars(description = "JSON string of the signed attestation document to export as DSSE")]
+    pub attestation_json: String,
+}
+
 /// Parameters for lifting a signed document to an attestation.
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 pub struct AttestLiftParams {
@@ -1594,6 +1602,13 @@ impl JacsMcpServer {
                  feature.",
                 Self::jacs_attest_lift_schema(),
             ),
+            Tool::new(
+                "jacs_attest_export_dsse",
+                "Export an attestation as a DSSE envelope for in-toto/SLSA compatibility. \
+                 Provide the signed attestation document JSON. Returns a DSSE envelope with \
+                 payloadType, payload, and signatures. Requires the attestation feature.",
+                Self::jacs_attest_export_dsse_schema(),
+            ),
         ]
     }
 
@@ -1852,6 +1867,14 @@ impl JacsMcpServer {
             _ => serde_json::Map::new(),
         }
     }
+
+    fn jacs_attest_export_dsse_schema() -> serde_json::Map<String, serde_json::Value> {
+        let schema = schemars::schema_for!(AttestExportDsseParams);
+        match serde_json::to_value(schema) {
+            Ok(serde_json::Value::Object(map)) => map,
+            _ => serde_json::Map::new(),
+        }
+    }
 }
 
 // Implement the tool router for the server
@@ -3981,6 +4004,39 @@ impl JacsMcpServer {
             }).to_string()
         }
     }
+    /// Export a signed attestation as a DSSE (Dead Simple Signing Envelope) for
+    /// in-toto/SLSA compatibility.
+    #[tool(
+        name = "jacs_attest_export_dsse",
+        description = "Export an attestation as a DSSE envelope for in-toto/SLSA compatibility."
+    )]
+    pub async fn jacs_attest_export_dsse(
+        &self,
+        Parameters(params): Parameters<AttestExportDsseParams>,
+    ) -> String {
+        #[cfg(feature = "attestation")]
+        {
+            match self.agent.export_attestation_dsse(&params.attestation_json) {
+                Ok(result) => result,
+                Err(e) => {
+                    let error = serde_json::json!({
+                        "error": true,
+                        "message": format!("Failed to export DSSE envelope: {}", e),
+                    });
+                    serde_json::to_string_pretty(&error)
+                        .unwrap_or_else(|e| format!("Error: {}", e))
+                }
+            }
+        }
+        #[cfg(not(feature = "attestation"))]
+        {
+            let _ = params;
+            serde_json::json!({
+                "error": true,
+                "message": "Attestation feature not available. Rebuild with --features attestation."
+            }).to_string()
+        }
+    }
 }
 
 // Implement the tool handler for the server
@@ -4035,7 +4091,8 @@ impl ServerHandler for JacsMcpServer {
                  \
                  Attestation: jacs_attest_create (create signed attestation with claims), \
                  jacs_attest_verify (verify attestation, optionally with evidence checks), \
-                 jacs_attest_lift (lift signed document into attestation). \
+                 jacs_attest_lift (lift signed document into attestation), \
+                 jacs_attest_export_dsse (export attestation as DSSE envelope). \
                  \
                  Security: jacs_audit (read-only security audit and health checks)."
                     .to_string(),
@@ -4090,6 +4147,7 @@ mod tests {
         assert!(names.contains(&"jacs_attest_create"));
         assert!(names.contains(&"jacs_attest_verify"));
         assert!(names.contains(&"jacs_attest_lift"));
+        assert!(names.contains(&"jacs_attest_export_dsse"));
     }
 
     #[test]