The evidence record : the non-authorizing result of a verification pass — per-surface checks, effective bounds, clamp evidence, and extension facts.
Evidence is not a decision. not_verified is mandatory and always
non-empty: build/1 unions in the seven host-owned surfaces this
protocol structurally cannot establish — tenancy, live policy,
authority, effect ownership, execution, billing, evaluation truth — so a
caller cannot read an %Evidence{} and conclude "everything is fine".
The seven are a module constant computed in at construction, never
passed; callers may only add surfaces they also did not establish.
The defstruct stays public-shaped (a struct is forgeable like any
struct — the same ruling as the struct-bypass rim): the constructor's
typed denials cover every malformed input shape, and the property lane
pins the seven-atom law over every path the package produces.
Summary
Functions
The only constructor the package uses. Accepts a keyword list or map of
the struct's own field names; :not_verified extras are UNIONED after
the seven host-owned atoms (duplicates collapse), never replacing them.
Unknown keys deny :unknown_member (subject is the containing surface,
never the forged key — an error is not an echo channel); malformed
:not_verified shapes deny :invalid_type with the member path.
Types
@type check() :: %{ surface: atom(), subject: [binary() | non_neg_integer()], verified: boolean(), detail: nil | AgentBlueprintProtocol.BoundsAlgebra.ClampEvidence.t() | AgentBlueprintProtocol.Digest.t() | binary() }
@type t() :: %AgentBlueprintProtocol.Evidence{ blueprint_digest: AgentBlueprintProtocol.Digest.t() | nil, checks: [check()], clamps: [AgentBlueprintProtocol.BoundsAlgebra.ClampEvidence.t()], deployment_digest: AgentBlueprintProtocol.Digest.t() | nil, effective_bounds: AgentBlueprintProtocol.BoundsAlgebra.BoundSet.t() | nil, not_verified: [atom()], optional_extensions_retained: [binary()], protocol_revision: pos_integer() | nil }
Functions
@spec build(keyword() | map()) :: {:ok, t()} | {:error, AgentBlueprintProtocol.Error.t()}
The only constructor the package uses. Accepts a keyword list or map of
the struct's own field names; :not_verified extras are UNIONED after
the seven host-owned atoms (duplicates collapse), never replacing them.
Unknown keys deny :unknown_member (subject is the containing surface,
never the forged key — an error is not an echo channel); malformed
:not_verified shapes deny :invalid_type with the member path.