[GH-ISSUE #21] Add evidence envelopes, artifact hashes, and reproducible exports #13

New issue

Closed

opened 2026-10-15 18:19:56 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:19:56 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/21

Problem

Results lack a uniform record of artifact identity, provider version, parameters, confidence, limitations, and evidence locations.

Scope

Add artifact SHA-256/format/architecture, provider identity/version, parsed parameters, raw and normalized results, observed/derived/inferred confidence, limitations, source locations, stable evidence IDs, investigation manifests, and JSON evidence export.

Acceptance criteria

Every workflow can emit evidence.
Unchanged artifacts have stable identity.
Reports cite evidence IDs and locations.
Secrets and arbitrary environment values never enter evidence.

Roadmap expansion

This remains the evidence/provenance epic.

Child work

Evidence IDs are computed from canonical JSON with recursively sorted object keys and stable array order. Local paths and the ID itself do not affect identity. Records distinguish raw and normalized results, observed/derived/inferred confidence, authority, environment, limitations, and typed locations. Import recomputes IDs and rejects tampering and conflicting duplicates. Evidence v2 is intentionally breaking.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/21 ## Problem Results lack a uniform record of artifact identity, provider version, parameters, confidence, limitations, and evidence locations. ## Scope Add artifact SHA-256/format/architecture, provider identity/version, parsed parameters, raw and normalized results, observed/derived/inferred confidence, limitations, source locations, stable evidence IDs, investigation manifests, and JSON evidence export. ## Acceptance criteria - Every workflow can emit evidence. - Unchanged artifacts have stable identity. - Reports cite evidence IDs and locations. - Secrets and arbitrary environment values never enter evidence. ## Roadmap expansion This remains the evidence/provenance epic. ### Child work - [x] #49 - [x] #50 - [x] #51 - [x] #72 - [x] #73 Evidence IDs are computed from canonical JSON with recursively sorted object keys and stable array order. Local paths and the ID itself do not affect identity. Records distinguish raw and normalized results, observed/derived/inferred confidence, authority, environment, limitations, and typed locations. Import recomputes IDs and rejects tampering and conflicting duplicates. Evidence v2 is intentionally breaking.

bsakaguchi

2026-10-15 18:19:56 +00:00

closed this issue
added the
area: server

P1: high

area: domain

roadmap

enhancement
labels

bsakaguchi commented

2026-10-15 18:19:57 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Completed on current . Evidence v2 now has canonical evidence/domain records and IDs, a ledger and bundle file/command application layer, MCP evidence tools/resources, canonical export, and import validation for tamper/conflict cases (, , , and the evidence test suites). Follow-on workflow refinements remain independently tracked.

@morluto commented on GitHub (Jul 17, 2026): Completed on current . Evidence v2 now has canonical evidence/domain records and IDs, a ledger and bundle file/command application layer, MCP evidence tools/resources, canonical export, and import validation for tamper/conflict cases (, , , and the evidence test suites). Follow-on workflow refinements remain independently tracked.

bsakaguchi commented

2026-10-15 18:19:58 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Correction to the preceding comment: completed on current main. Evidence v2 includes src/domain/evidence.ts and evidenceBundle.ts; the EvidenceLedger, EvidenceBundleFiles, and EvidenceBundleCommands application layer; MCP evidence tools and resources; canonical export; and tamper/conflict import validation in the evidence test suites.

@morluto commented on GitHub (Jul 17, 2026): Correction to the preceding comment: completed on current main. Evidence v2 includes src/domain/evidence.ts and evidenceBundle.ts; the EvidenceLedger, EvidenceBundleFiles, and EvidenceBundleCommands application layer; MCP evidence tools and resources; canonical export; and tamper/conflict import validation in the evidence test suites.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:11:14 +00:00

[PR #13] [MERGED] docs: redesign and localize README #1808

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:37 +00:00