Security evidence

What we study

What a record has to hold.

What belongs in one observation?

Approved identity, reported identity, policy result and arrival time.

How is missing evidence recorded?

As unavailable, with a reason. Never as the last known state.

Can a reader tell a self-report from proof?

Only if every record carries its scope.

How does a record stay in order?

Discrepancies, gaps and recovery in one sequence, nothing hidden.

What exists today

Recorded observations, in the experiment.

• Working in the experimentDeployment evidence: four observations recorded in order, including evidence unavailable.
• Working in the experimentEach keeps the approved identity, the worker's reported runtime identity and the policy result.
• Working in the experimentRecovery verification: after one recorded explicit reload, the reported identity was compared again.
• Working in the experimentThe app refuses to import pending, missing evidence or wrong runtime observations as matched.
• ProposedRecovery failure tests, specified but not run, and an investigation workflow.
• Not claimedIndependent attestation. Every record is a worker self-report.

What is still open

Edited records

An edited, self-consistent trace still validates today.

Evidence freshness

Heartbeats that show a report is current, not stale. Not built.

Expected silence

Telling a planned outage from a fault.

Reviewer effort

Time for an outsider to reach a conclusion. Not measured.

How it connects to Vraelis Contour

Draws on directly: Ordered observations, including unavailable evidence.

On vraelis.com: Security evidence, Recorded observations, Government and institutions.