evidence

Documentation

Overview

Package evidence binds a declared behavioral check to one process invocation. It consumes structured observations, never natural-language log output.

Index

• Constants
• func HasAdverse(s *Summary, d *Declaration, baseline bool) bool
• func ReadInput(root, p string) ([]byte, error)
• func ValidPath(p string) bool
• func ValidateStored(s *Summary, d *Declaration, binding string, baseline bool, result string, ...) error
• type Declaration
  • func Load(root, p string) (*Declaration, string, error)
  • func (d *Declaration) Validate() error
• type Invocation
  • func Prepare(parent string) (*Invocation, error)
  • func (i *Invocation) Classify(d *Declaration, binding string, process run.Result, baseline bool) Summary
  • func (i *Invocation) Close() error
  • func (i *Invocation) Env(binding string) []string
• type Observation
• type Report
• type Summary
• type Target

Constants

const (
	DeclarationSchema = "check-declaration/v1"
	ReportSchema      = "check-result/v1"
	SummarySchema     = "check-evidence/v1"
)

Functions

func HasAdverse

func HasAdverse(s *Summary, d *Declaration, baseline bool) bool

HasAdverse preserves assertions even when another observation makes the overall result error or unknown. Callers must first validate the stored summary against its current declaration with ValidateStored.

func ReadInput

func ReadInput(root, p string) ([]byte, error)

ReadInput reads a tracked regular input without traversing symlinks. No Git mutation or source rewrite is performed. Inputs must equal HEAD even when their paths are otherwise excluded from ordinary working-tree checks.

func ValidPath

func ValidPath(p string) bool

ValidPath accepts a canonical repository-relative file path.

func ValidateStored

func ValidateStored(s *Summary, d *Declaration, binding string, baseline bool, result string, exit *int) error

ValidateStored rechecks compact evidence without the original report/log. It does not reinterpret historical /1 or /2 records; callers select the rule.

Types

type Declaration

type Declaration struct {
	Schema          string   `json:"schema"`
	Producer        string   `json:"producer"`
	ProducerVersion string   `json:"producer_version"`
	ProducerPaths   []string `json:"producer_paths"`
	Targets         []Target `json:"targets"`
}

func Load

func Load(root, p string) (*Declaration, string, error)

Load validates a declaration and binds its raw bytes and every producer file.

func (*Declaration) Validate

func (d *Declaration) Validate() error

type Invocation

type Invocation struct {
	ID   string
	Path string
	// contains filtered or unexported fields
}

func Prepare

func Prepare(parent string) (*Invocation, error)

Prepare reserves a private, previously unused location and unpredictable ID. The caller closes it after storing the compact classification.

func (*Invocation) Classify

func (i *Invocation) Classify(d *Declaration, binding string, process run.Result, baseline bool) Summary

func (*Invocation) Close

func (i *Invocation) Close() error

func (*Invocation) Env

func (i *Invocation) Env(binding string) []string

type Observation

type Observation struct {
	Target    string `json:"target"`
	Attempt   int    `json:"attempt"`
	Status    string `json:"status"`
	Violation string `json:"violation,omitempty"`
	Reason    string `json:"reason,omitempty"`
}

type Report

type Report struct {
	Schema            string        `json:"schema"`
	Invocation        string        `json:"invocation"`
	DeclarationDigest string        `json:"declaration_digest"`
	Producer          string        `json:"producer"`
	ProducerVersion   string        `json:"producer_version"`
	AttemptsComplete  bool          `json:"attempts_complete"`
	Observations      []Observation `json:"observations"`
}

type Summary

type Summary struct {
	Schema            string        `json:"schema"`
	Result            string        `json:"result"`
	Reason            string        `json:"reason"`
	DeclarationDigest string        `json:"declaration_digest"`
	ReportDigest      string        `json:"report_digest,omitempty"`
	Invocation        string        `json:"invocation"`
	Targets           []Observation `json:"targets,omitempty"`
}

Summary contains only bounded identifiers, normalized observations and codes. Raw report bytes and arbitrary runner messages never enter a run record.

type Target

type Target struct {
	ID        string `json:"id"`
	Violation string `json:"violation"`
}