Evidence

An evidence artifact is any bytes a run produced that an oracle may read: screenshots, terminal output, request and response payloads, database snapshots, fixtures, oracle program sources. Each is stored under the hash of its own bytes, so the same content is stored once and a wrong artifact is never amended — it is superseded by a new one with a new hash.

The ledger is the ordered record of what happened. Each entry names the run, the claim, the step, the attempt, which side it was on, the capability that acted, the action, hashes of its inputs and outputs, the artifacts it produced, and what was redacted.

Two clocks are kept and only one is trusted. The broker's clock orders everything, windows everything and satisfies every timestamp check. The source's own claimed time is retained too, because the difference between them is itself evidence — and because a sandbox clock is set by the repository under test.

A side is base, head, or control. The third is a deliberate negative-control experiment, not the other twin.

Not all evidence is equally trustworthy, and the difference is mechanical rather than a judgement. Every artifact is tiered by who authored the bytes, assigned from the producing capability's authenticated identity as the broker recorded it — never self-declared, never read from inside the content.

control plane

Ledger rows, broker timestamps, refusals, egress denials, lease records, the signed manifest.

Certus, outside the sandbox

The interceptor's wire trace, fixture-plane reads, facts the hypervisor reports.

Certus, inside the sandbox

The agents that share a machine with your code.

the application

Its own logs, its self-reported metrics, the response bodies it authored.

The rule that follows: the application's own account of itself never stands alone. A PASS must carry at least one corroborating artifact produced outside the sandbox. Tier follows the author of the bytes, not the courier — an agent collecting your application's log file is a trusted act of collection producing an untrusted artifact.

Every output passes through the broker, which walks it and replaces leased values, access keys, private keys and control-plane tokens before anything is stored. The record keeps which rule fired and where — never the value.

The ordering is not incidental. The hash of an artifact enters the tree the manifest signs, so redacting afterwards would invalidate every signature over it, and — far worse — would mean a secret had already been committed to addressed, signed content. A “redact it later” path cannot exist.

Input and output hashes are computed after redaction too, so a leased credential never enters a hash anyone could search against. There is no per-call override, no privileged capability and no policy tier that turns this off.

The evidence root is the hash over the run's whole ledger, canonically serialized. It appears on the verdict and is what you quote when you want to point at exactly this run's record.

The run manifest closes the run: the two commits, the recipe hash, the plan hashes, the oracle hashes, the evidence root, the verdict hash, and a signature over all of it.

Signing proves three separable things. Integrity: the evidence has not changed after the fact, including by Certus. Provenance: each artifact is attributable to a specific brokered action, on a specific side, at a specific time on the broker's clock. Reproducibility: the verdict can be produced again from the record.

The Evidence view lists the artifacts a run produced. Opening one issues a short-lived signed URL — fifteen minutes — after an authorization check. A hash is not itself a key: asking for an artifact checks that you can see a run whose ledger references it.

How long a run's evidence stays readable is a plan term: seven days on Starter, ninety on Team, and as long as the ledger holds it on Enterprise. The Evidence view states the window and the day this run leaves it, and past that day the read is refused as gone rather than missing — the run happened, and a longer window is a plan away.

When a heavy artifact has been collected, its ledger row stays and records that the bytes are gone. A replay of that run then reports the evidence as evicted and declines to claim it reproduced anything, rather than quietly reconstructing less than it had.

An artifact the ledger names that will not open

Either the signed URL expired — re-open it — or the run has left this plan's retention window, which the view states as gone rather than as missing.

Evidence that does not match its hash

Re-hash and compare; corruption is detectable by construction. A mismatch is a defect worth reporting, not something to work around.

A field you expected that is redacted

Working as intended and not recoverable. The record tells you which rule fired and where, which is enough to fix the leak at its source.

Your application's log says one thing and the wire trace another

Believe the wire trace. It was produced outside the sandbox; the log was produced by the code under examination.

A wrong ledger entry

It is never edited. A correction is a new entry, which is why the record can be signed at all.