Artifact & Evidence Contract

Artifact & Evidence Contract

A verification statement is meaningful only when the subject of the statement is identifiable.

This page describes common consumer expectations across DigiEmu workflows.

Artifact identity

A consumer should be able to determine which exact artifact, state, bundle, or structured result is referenced.

Identity may include an integrity value, but an integrity value by itself does not describe the whole verification boundary.

See:

• Artifact Types
• Integrity Concepts
• Integrity Hash Example

Evidence relationship

Evidence should make it possible to understand why a verification outcome was produced.

Depending on the workflow, evidence can include:

• preserved inputs;
• integrity identities;
• configuration or policy inputs;
• replay or reconstruction material;
• provenance relationships;
• explicit verification results.

See Evidence Fields.

Verification boundary

Consumers should distinguish:

• what was checked;
• what was not checked;
• what was reconstructed or replayed;
• which assumptions remained external to the verification.

A hash match, for example, can establish equality with an expected hash value. It does not by itself prove that the artifact is semantically correct, authorized, safe, or fit for a particular purpose.

Handoff

When evidence leaves the original project boundary, preserve enough context for an independent reviewer to identify the artifact and repeat the intended verification step.