Module evidence 

Run lifecycle: prepare, capture (the agent’s job), finalize, abort, resume; plus chain verification.

The seam is the directory layout under evidence/<y>/<q>/<id>/<run-id>/ described in docs/storage.md. The binary owns every state-changing filesystem operation; the agent only writes data files into the slots prepare carved out.

Modules

hasher

SHA-256 over files and serialized JSON, plus atomic write helpers.

lock

Advisory file lock at <root>/.secunit.lock. Concurrent invocations against the same root serialise on this lock so state.json writes never interleave.

manifest

Strongly-typed prepare / result / manifest payloads. Each maps 1:1 to its JSON Schema under schemas/.

runner

prepare → (skill executes) → finalize, plus abort and resume.

verifier

Walk every run for a control (or all controls) in chronological order, recompute artifact hashes, and check each prior_run.manifest_sha256 against the recomputed sha of the prior manifest.