One signed second-observer observation in full: the envelope (fetches with status, headers kept, sha256 of each body), the run key's Ed25519 signature, GitHub's OIDC token binding the key to the enrolled workflow, the checks run on receipt and the readings derived from the bytes. Public