Module evidence 

The Evidence (ε) — a signed verdict, not a claim.

Law III: model output is a proposal, never ground truth. No state change commits on probabilistic output. A step commits only on Evidence from a deterministic checker or a statistical quorum.

Three details do the real work here, and each closes a specific hole:

• Verdict has no implicit pass. Inconclusive is its own case, so a checker that timed out cannot be mistaken for one that succeeded.
• Evidence::inputs lists digests. Evidence names exactly what was checked, so it cannot later be re-pointed at different data. Without this a passing verdict could be harvested and reattached to a failing patch.
• The signature covers everything else. An unsigned verdict is indistinguishable from a claim someone typed.

This module defines the type. Producing signatures is US-0802, and key management is still open (ARCHITECTURE.md §17) — which is precisely why SigningKeyId is recorded alongside every signature: a verifier must know which key to check against without that decision being baked in here.

Structs

CheckerId

Which checker produced a verdict, and at what version.

Evidence

ε — a signed verdict from a checker or a quorum.

Signature

An ed25519 signature over the canonical encoding of an Evidence.

SigningKeyId

Identifies the key a signature was made with.

Enums

EvidenceKind

How a verdict was reached.

Verdict

The outcome of a check.