The evidence contract

A decision report is only as good as the evidence beneath it. Four properties make that evidence something a third party can check rather than something they must take on trust.

It is signed

Evidence carries a cryptographic signature binding the verdict to the measurement that produced it. Assay checks that signature before anything else happens. Evidence whose signature does not authenticate is refused outright.

The verdict is reproduced, not accepted

Checking a signature only proves the package was not altered. It does not prove the verdict inside follows from the measurements inside. So the verdict is independently re-derived from the evidence and compared with what the evidence claims. Both must agree.

A report is built only when the signature is authentic and the verdict reproduces. Anything else is a recorded failure.

It names what it measured

Evidence identifies the exact commit assessed and the exact rubric version it was scored under. A score with neither would be uncheckable — nobody could establish what was measured or by which definition of good.

Rubrics are published openly and never change once published, so a rubric named in a years-old report can still be fetched and read in full. The rubric archive is public and requires no account.

The report is frozen

What was served to a buyer is stored exactly as served. Rebuilding history reproduces the same bytes. Later changes — to the bar, to the supplier's code, to our own system — cannot reach back and alter a report that has already been issued.

What this adds up to

A buyer holding a decision report can establish, without trusting us:

which software was assessed, at which exact version;
which published standard it was assessed against;
that the underlying measurement was genuine and unaltered;
that the verdict follows from the measurement.

That is the whole purpose of the constraints on this page. Each one removes a way the answer could have been shaped by the party with an interest in it.