An in-toto Statement (_type https://in-toto.io/Statement/v1) lists subject artifacts by name and digest and carries a predicateType URI with a predicate object: SLSA provenance, SPDX or CycloneDX SBOMs, vulnerability scans, test results or custom types. It is wrapped in a DSSE envelope and signed, typically with Sigstore, so the signature covers both the payload and its type.
The original in-toto layout specification also defines expected steps, functionaries and inspections for a whole pipeline; most adoption today uses only the attestation format. Verifiers should match subjects by digest, check the predicate type they expect and evaluate policies over the predicate contents. The in-toto attestation viewer decodes envelopes and statements.