States and codes

The trace uses three statuses and one reason code. The evidence app adds its own reason codes when it refuses a file.

Observation statuses

In the trace	Shown as	Meaning
`matched`	Matched	Every identity field is equal, and the reported runtime satisfies the policy.
`pending`	Reload pending	The reported identity differs from the approved one; in baseline mode the runtime waits for an explicit reload.
`unknown`	Evidence unavailable	There is no loaded report. The observation carries a reason code and no loaded identity.

Reason codes in the trace

Code	Meaning	Seen in
`RUNTIME_UNAVAILABLE`	The runtime did not report; the loaded state cannot be confirmed.	Observation 04

When the evidence app refuses a file

The app checks a trace's structure and consistency when it opens it, and refuses the whole file if any check fails. Every refusal carries a reason code and a readable message, and a refused file leaves the open state exactly as it was.

Code	When
`TRACE_TOO_LARGE`	The input exceeds the 5,000,000-byte file limit.
`TRACE_NOT_JSON`	The input cannot be parsed as JSON.
`TRACE_UNSUPPORTED`	The file has an unsupported schema, kind or top-level structure, or its event count is outside 1–1,000.
`TRACE_TEXT_INVALID`	Text or an identifier is missing, malformed, too long or contains characters the app does not display.
`TRACE_UNCHECKED_CLAIM`	Displayed text claims verification, attestation, authentication, signing, trust or certification that the app cannot check.
`TRACE_TIMESTAMP_INVALID`	A timestamp is not a real date and time with an explicit zone.
`TRACE_POLICY_INVALID`	The recorded policy or its runtime requirements are missing, malformed or unsupported.
`TRACE_TOOLCHAIN_INVALID`	The optional recorded toolchain is malformed.
`TRACE_OBSERVATION_UNSUPPORTED`	An event, observation, session identifier or loaded-evidence marker has an unsupported shape or value.
`TRACE_REASON_CODE_INVALID`	An observation's reason code is malformed.
`TRACE_IDENTITY_INVALID`	Required release identity fields are missing or malformed.
`TRACE_LOADED_ON_UNAVAILABLE`	An unknown observation carries a loaded report, which this viewer does not support.
`TRACE_RUNTIME_MISSING`	A matched or pending observation has no valid reported runtime.
`TRACE_STATE_CONTRADICTION`	The recorded matched or pending status contradicts the desired and loaded identity fields.
`TRACE_RUNTIME_POLICY_UNSATISFIED`	The reported ONNX Runtime version or providers do not satisfy the policy contained in the file.

The app also refuses displayed text that claims verification, attestation, signing or trust, look-alike and control characters in displayed text, and defined fields with malformed values. These import checks establish internal consistency, not authenticity: a self-consistent edited file can pass and remains labelled imported, not verified. Unknown fields are retained as unvalidated extras in raw JSON and export, not rendered as validated facts. Its tests list each case: The evidence app.

Policy fields the runtime checks

policy cpu-lab, version 1JSON

{
  "schemaVersion": 1,
  "policyId": "cpu-lab",
  "version": "1",
  "environmentId": "non-actuating-lab",
  "resourceId": "onnx-cpu",
  "publishers": ["publisher"],
  "deployers": ["deployer"],
  "approvers": ["approver"],
  "maxAgeMs": 60000,
  "runtime": {
    "ortVersion": "1.23.2",
    "executionProviders": ["CPUExecutionProvider"]
  }
}

Last updated: October 12, 2026