Evidence
AI-readable evidence
Curated, machine-readable artifacts for reviewers and LLM crawlers. Proof status is scoped; local, mock, and staging results do not equal production readiness or customer-ready operation.
DEMO scope only unless a linked artifact explicitly states otherwise. See non-claims before inferring compliance or production-live status.
Entry points
- public-surface-traceability.json — public AI surface changelog (capability language only)
- public-terminology-taxonomy.json — internal-ref → public capability map (regression gate)
- Public terminology guide — human-readable taxonomy
- llms.txt — concise site index for LLMs
- llms-full.txt — expanded context (community convention)
- Docs llms.txt — documentation hub mirror
- Quick start — sandbox-oriented setup
Machine-readable JSON
- manifest.json — capability registry and proof_status
- manifest.schema.json — manifest schema
- non-claims.json — global non-claims
- wedge-claim-map.json — scoped wedge claims
- wedge-non-claims.json — wedge non-claims
- compliance-map.json — internal readiness mapping (not certification)
- compliance-map.schema.json — compliance map schema
Machine-readable security
- v1-security-validation-summary.json — machine-readable V1 security validation summary
- claim-maturity.json — claim maturity per control
- attack-model.json — attack model and non-claims per attack
- gaps.json — explicit post-V1 security gaps
- primitives.json — security primitives
Narrative context (not proof)
Blog posts and the narrative registry explain why evidence matters. They are
narrative_context only — not accepted_evidence, not
proof_status, and not substitutes for manifest entries or hash-chain receipts.
- narrative-context.json — machine-readable registry (narrative_context classification)
- Webhook delivery evidence (blog) — delivery logs vs verifiable evidence
- Webhooks behind firewalls (blog) — control/data/edge separation narrative
- All blog posts
Human guides
- AI overview
- Verification guide
- Evidence schema guide
- Non-claims (docs)
- Security architecture
- V1 security validation summary — local/sandbox attack validation; cloud-gated checks not yet complete
Proof status legend
- PROVEN
- Evidence artifact exists with stated scope (may still be local/mock).
- PARTIAL
- Some criteria met; gaps documented in linked artifacts.
- PLANNED
- Not yet validated; roadmap or design only.
- NOT_CLAIMED
- Explicitly out of scope for the wedge or product surface.
- BLOCKED
- Cannot advance without owner decision or missing dependency.
Current providers
| Provider | Header validation | Status |
|---|---|---|
| Stripe | Native signing secret | PROVEN |
| GitHub | HMAC-SHA256 | PROVEN |
| Shopify | HMAC-SHA256 | PROVEN |
| Twilio | HMAC-SHA256 | PARTIAL |
| Custom | HMAC-SHA256 | PROVEN |