gleamunison/evidence

Types

AttachError

pub type AttachError {
  StoreFailed(String)
}

Constructors

```
StoreFailed(String)
```

Evidence

</>

A fact about a definition hash, stored as a CAS chunk. The chunk’s own hash is the evidence identity; the subject is the hash it attests to.

pub type Evidence {
  Evidence(
    subject: String,
    kind: Kind,
    verdict: String,
    payload: String,
    ts: Int,
    signer: String,
    signature: String,
  )
}

Constructors

Evidence(
  subject: String,
  kind: Kind,
  verdict: String,
  payload: String,
  ts: Int,
  signer: String,
  signature: String,
)

Kind

</>

What kind of evidence this is. Deploy gates ask for these by name.

pub type Kind {
  Test
  Review
  PropertyCheck
  Io
}

Constructors

```
Test
```
```
Review
```
```
PropertyCheck
```
```
Io
```
Human attestation that an effectful definition behaves: “I ran it and it worked.” The only honest evidence for IO a suite cannot drive.

Signer

</>

pub type Signer {
  Signer(id: String, secret: BitArray)
}

Constructors

```
Signer(id: String, secret: BitArray)
```

Snapshot

opaque </>

One operation-local view, keyed by subject. Tampered/non-evidence chunks remain excluded; I/O failure is explicit, never an incomplete snapshot.

pub opaque type Snapshot

Values

attach

</>

pub fn attach(
  adapter: storage.StorageAdapter,
  subject subject: String,
  kind kind: Kind,
  verdict verdict: String,
  payload payload: String,
  ts ts: Int,
) -> Result(#(identity.DefinitionRef, String), AttachError)

Legacy local fixture helper. Production callers must use attach_signed.

attach_signed

</>

pub fn attach_signed(
  adapter: storage.StorageAdapter,
  signer signer: Signer,
  subject subject: String,
  kind kind: Kind,
  verdict verdict: String,
  payload payload: String,
  ts ts: Int,
) -> Result(#(identity.DefinitionRef, String), AttachError)

Store signed evidence. The secret itself is never serialized.

describe_attach_error

</>

pub fn describe_attach_error(error: AttachError) -> String

The one place an AttachError becomes a user sentence. Rendering belongs here, with the type, rather than at each call site — inspect output is a debug rendering and must never reach a user.

from_snapshot

</>

pub fn from_snapshot(
  snapshot: Snapshot,
  subject: String,
) -> List(Evidence)

kind_name

</>

pub fn kind_name(k: Kind) -> String

Public name for a kind — reports, CLIs, and MCP tools all render the same word.

production_signer

</>

pub fn production_signer() -> Result(Signer, String)

secure_compare_hex

</>

pub fn secure_compare_hex(a: String, b: String) -> Bool

Constant-time hex comparison for signature checks outside this module.

sign

</>

pub fn sign(
  signer: Signer,
  subject: String,
  kind: Kind,
  verdict: String,
  payload: String,
  ts: Int,
) -> Evidence

Create an identity-bearing evidence record.

signer

</>

pub fn signer(id: String, secret: BitArray) -> Signer

Construct a local signer. The secret remains in memory and is never serialized into evidence; only the stable signer id and HMAC are stored.

snapshot

</>

pub fn snapshot(
  adapter: storage.StorageAdapter,
) -> Result(Snapshot, storage.StorageError)