Evidence index
The reviewer's entry point to the evidence behind the repository-quality assurance case: what each class of evidence supports, where it lives, and what keeps it honest. A few rows are not cited by the case directly but contextualize it; they are listed so the picture is complete. For readers who want the conclusion chain without walking the full case.
Evidence is only listed here if it is reproducible — a command, a gate, or a committed record. Prose that merely asserts quality is not evidence and does not appear.
| Evidence | Supports | Where | Kept honest by |
|---|---|---|---|
| Capability matrix | What the tool can do, per capability | feature-matrix.md | feature_matrix_check: supported requires a cited, existing test |
| SACM conformance matrix | What the library implements of SACM 2.3 | sacm-conformance-matrix.md | sacm_matrix_check: verified requires an ID-bearing test; cited paths must exist |
| Compliance-point tests | The four claimed interchange points | sacm-compliance-points.md | SACM23_CP_001..004 — the unit-of-interchange tests (strict-load root assertions) |
| Matrix-completeness audit | That the matrix is missing nothing unexamined | sacm-matrix-completeness-audit.md | Findings tracked as issues #333–#337; frozen into each evidence package |
| Verification records | That verified meant a real, adversarial pass |
verification/ | verification_index_check; FAIL rounds committed — the generated index is the count source, and FAIL verdicts outnumber passes |
| Preservation record | That data loss was measured, fixed, and pinned | sacm-integration-preservation.md | Byte-pinned SACM23_LIB_002 tests; mechanical known-lost-kinds sweep |
| Layer gate + self-test | Dependency direction | cmake/check_layer_gates.cmake |
layer_gate_negative_check feeds it violations it must reject |
| Architecture record | Subsystem responsibilities and ownership | layers-and-ownership.md | documentation_check: must describe every gated subsystem |
| Migration plan | What is transitional and its retirement conditions | legacy-bridge-migration-plan.md | Observable exit criteria per phase |
| ADRs | Why boundaries are where they are | decisions/ | One decision per record; append-only |
| Quality baseline | Measured repository state | repository-baseline.md | Reproduction commands on the page; deliberately a dated snapshot |
| Hotspot register | Where cleanup pays, ranked by risk | hotspot-register.md | Published inputs and commands; staleness criterion on the page |
| Code quality controls | Warnings, static analysis, sanitizers | code-quality-policy.md | Warnings-as-errors in CI; version-pinned clang-tidy ratchet; ASan/UBSan workflow |
| Documentation authority | One canonical home per policy | documentation-map.md | documentation_check: links, reachability, generated banners |
| Release evidence package | Claims bound to an exact release | sacm-conformance-statement.md | evidence_package_check; generated by CI from a clean checkout, attached per release |
| Agent authority | What AI agents may do and write | .agents/ |
agent_definition_check: adapters generated, drift fails |
| Consent boundaries | No data leaves without explicit consent | ADRs 0005, 0007, 0010 | Recorded decisions; tests on the consent seams |
| Security policy + parser hardening | Reporting path; XML attack surface | SECURITY.md | SACM23_SEC_001_RejectsDoctype: DOCTYPE/ENTITY rejected before parsing |
| Test suite + CI | Everything above, continuously | .github/workflows/ (CI, coverage, sanitizers, clang-tidy) |
Three platforms; ctest gates labelled gate run in about a second |
How to audit a claim from here
- Pick the claim in the assurance case.
- Follow its evidence link in the table above; each destination states its own reproduction command or names its gate.
- Check the challenge register — if the claim has a live counter-claim, the honest reading is the bounded one.
- For a release rather than
main, download that release's evidence package; it freezes the matrix, the audit, the records and the test results at the released commit.