gleamunison/evidence

Types

AttachError

pub type AttachError {
  StoreFailed(String)
}

Constructors

```
StoreFailed(String)
```

Evidence

</>

A fact about a definition hash, stored as a CAS chunk. The chunk’s own hash is the evidence identity; the subject is the hash it attests to.

pub type Evidence {
  Evidence(
    subject: String,
    kind: Kind,
    verdict: String,
    payload: String,
    ts: Int,
    signer: String,
    signature: String,
  )
}

Constructors

Evidence(
  subject: String,
  kind: Kind,
  verdict: String,
  payload: String,
  ts: Int,
  signer: String,
  signature: String,
)

Kind

</>

What kind of evidence this is. Deploy gates ask for these by name.

pub type Kind {
  Test
  Review
  PropertyCheck
  Io
}

Constructors

```
Test
```
```
Review
```
```
PropertyCheck
```
```
Io
```
Human attestation that an effectful definition behaves: “I ran it and it worked.” The only honest evidence for IO a suite cannot drive.

Signer

</>

pub type Signer {
  Signer(id: String, secret: BitArray)
}

Constructors

```
Signer(id: String, secret: BitArray)
```

VerificationPolicy

</>

pub type VerificationPolicy {
  AllowUnsigned
  RequireTrusted(List(Signer))
}

Constructors

```
AllowUnsigned
```
Compatibility mode for in-memory/unit fixtures only.
```
RequireTrusted(List(Signer))
```
Production mode: only a matching signer id and HMAC can admit evidence.

Values

allow_unsigned

</>

pub fn allow_unsigned() -> VerificationPolicy

attach

</>

pub fn attach(
  adapter: storage.StorageAdapter,
  subject subject: String,
  kind kind: Kind,
  verdict verdict: String,
  payload payload: String,
  ts ts: Int,
) -> Result(#(identity.DefinitionRef, String), AttachError)

Legacy local fixture helper. Production callers must use attach_signed.

attach_signed

</>

pub fn attach_signed(
  adapter: storage.StorageAdapter,
  signer signer: Signer,
  subject subject: String,
  kind kind: Kind,
  verdict verdict: String,
  payload payload: String,
  ts ts: Int,
) -> Result(#(identity.DefinitionRef, String), AttachError)

Store signed evidence. The secret itself is never serialized.

for_subject

</>

pub fn for_subject(
  adapter: storage.StorageAdapter,
  subject: String,
) -> List(Evidence)

Every well-formed, untampered evidence record for a subject hash. Tampered chunks and non-evidence chunks are silently excluded.

kind_name

</>

pub fn kind_name(k: Kind) -> String

Public name for a kind — reports, CLIs, and MCP tools all render the same word.

production_policy

</>

pub fn production_policy() -> Result(VerificationPolicy, String)

production_signer

</>

pub fn production_signer() -> Result(Signer, String)

require_signer

</>

pub fn require_signer(signer: Signer) -> VerificationPolicy

sign

</>

pub fn sign(
  signer: Signer,
  subject: String,
  kind: Kind,
  verdict: String,
  payload: String,
  ts: Int,
) -> Evidence

Create an identity-bearing evidence record.

signer

</>

pub fn signer(id: String, secret: BitArray) -> Signer

Construct a local signer. The secret remains in memory and is never serialized into evidence; only the stable signer id and HMAC are stored.

verified

</>

pub fn verified(
  adapter: storage.StorageAdapter,
  subject: String,
  kind: Kind,
) -> Bool

Compatibility helper for local fixtures. Production/package gates should call verified_with_policy with RequireTrusted.

verified_with_policy

</>

pub fn verified_with_policy(
  adapter: storage.StorageAdapter,
  subject: String,
  kind: Kind,
  policy: VerificationPolicy,
) -> Bool