An autonomous engineer should be able to prove what happened.

Evidence is a record of what an autonomous engineer did, kept in a form that someone else can check without asking the engineer. It is separate from the output. A pull request can look correct and still say nothing about how it was produced, who reviewed it, or what authority was in force.

Numinance defines this record as part of the open specification, as the evidence/v1 format. The format is independent of the private engine.

Records are appended in order and never edited. Each record carries a reference to the digest of the record before it. Change an earlier record and every later reference stops matching.

That makes tampering detectable and tells you where it happened. It also means the chain alone proves little: someone who controls the whole chain can rebuild it end to end.

To close that gap, the design pairs the chain with signed material from the runner and with an append-only log kept outside the runner’s control. Conceptually, the runner signs what it did, and the log commits to the fact that the record existed.

How receipts and log entries are encoded, and how they are checked, is defined in the specification. See the reference.

Evidence leaves the system as an export directory. It is a folder with a defined layout, not a single JSON file. The verifier expects that layout and is not meant to be pointed at arbitrary files.

You can hand an export to an auditor, a customer or a different team. They do not need an account, a network path to the engine, or its source.

An export can carry keys. Those keys cannot vouch for the export, because whoever produced the bundle could have supplied them. Trust has to come from outside it.

So a fully verified result requires the caller to supply the runner key(s), the log key and the log origin, subject to the specification. Without them, the verifier can still tell you the chain is internally coherent. That is a weaker statement, and the toggle above shows the difference. The levels are verified, failed, unauthenticated, self-consistent, incomplete, unsigned and unanchored. There is no built-in trust root, and a key that comes from the export never reaches verified.

The verifier is a public tool in numinance-spec. It runs offline, on an export directory, with the keys you provide. It does not call the engine.

The command is numi evidence verify --runner-key FILE --log-key FILE --log-origin ORIGIN DIR. A key mode is required: without one it exits 2. Pinned keys can reach verified; --trust-bundle-keys tops out at self-consistent and --skip-signatures atunauthenticated. See the CLI reference.

• That the engineer’s code is correct or free of defects.
• That a policy was well written. It can show a decision was recorded, not that the decision was wise.
• That anything unrecorded did not happen.
• Anything about a key you pinned without checking where it came from.
• Anything beyond the guarantees the specification states for the level reported.

Evidence narrows what you have to take on faith. It does not remove the need for review. Read the technical reference, or see the open protocol around it.