Review an observation
Five checks, in order. Each one says what to look at in the evidence app and what the answer means.
The checks
- Status.
matched,pendingorunknown. It tells you which of the next checks matter. - Desired. Which release was approved: its id, generation and the four digests (model, configuration, release, receipt).
- Loaded. Which release the runtime reports, field by field beside the desired one. Any differing digest is marked.
- Runtime. Whether the reported ONNX Runtime version and execution providers satisfy the policy. Python is recorded only.
- Provenance. Where the observation came from (the worker's self-report), when it was received, and its reason code if there is one.
What each state means
| State | Typical cause | What it tells a reviewer | What to check next |
|---|---|---|---|
Matched (matched) | The approved release is loaded and the runtime satisfies the policy. | The worker reports running exactly what was approved. | Nothing for this observation. The claim rests on the worker's self-report. |
Reload pending (pending) | A new release was approved while the runtime keeps its loaded baseline. | Approved and running differ, intentionally, until an explicit reload. | Whether a reload is expected, and the next observation after it. |
Evidence unavailable (unknown) | No loaded report, for example RUNTIME_UNAVAILABLE when the worker stopped. | There is no evidence of what is loaded at this point. | Why reporting stopped, and the first observation after it resumes. |
What no state tells you
How the model behaves, whether the host is honest, or anything about machines outside the experiment. See Limits.
Last updated: October 12, 2026