emergent-security/knowledge/cards/evidence.md

Evidence and decision binding

access-engine's decision envelope identifies exact request binding, provenance, policy/fact versions, effect and lifetime. Required human approvals are separate approval-engine objects, with consume-before-effect semantics where applicable. The PEP owns verification and outage behavior. Knowledge receipts only show which orientation package and sources were consulted.

audit-core is evidence custody, not the source of every event. Integrity after arrival does not prove no event was omitted before arrival. A load-bearing source needs its own emission guarantees and reconciliation; use the source owner's contract. Route a missing-event investigation to the emitting source owner, whose identity must be resolved if unknown. audit-core can verify custody after arrival; it cannot establish that a source emitted every required event. No record cannot be interpreted as no event. Local files are not independent append-only custody merely because an agent did not edit them.

Keep identity/task/grant/effect attribution reconstructable without secret values. The Statehub read model records work and decisions for coordination; it is not runtime approval authority. Missing evidence should be produced by legitimate tests or checks, or escalated. Do not claim observation, signature verification, live readiness, or owner assent from a reference fixture.

Source owner IDs (cite the relevant owner, not an invented umbrella): audit-core, access-engine, approval-engine, net-kingdom.