Evidence and signatures

Evidence is structured, source-bound proof. Typical evidence includes commands, exit status, selected output, artifact digests, environment facts, and redaction metadata.

Signatures bind reports and decisions to:

• the Execution Package;
• the source commit;
• the evidence manifest;
• the verifier identity;
• the applicable policy version.

A signature proves integrity and provenance, not correctness by itself. Correctness still depends on meaningful tests, independent verification, and accountable review.