Evidence ledger · Refreshed 2026-07-14

Proof before promise

Each entry connects one public claim to a repository contract and a recorded verification path. The three modules are at different maturity levels, so the evidence layer is stated explicitly.

Evidence summary

1. Repository verification: recorded repository verification commands and expected results for Activity, Govern, and Relay. Where prerequisites, repositories, or artifacts are not fully public, these records are not described as independently reproducible.
2. Reference integration verification: Hanken exercises the Govern integration contract as a reference host. It is not customer or design-partner evidence.
3. Customer pilot evidence: not yet public. Production operation is a controlled pilot delivery goal, not a claimed deployment record.
4. Production-scale operational evidence: not yet public. No public scale, availability, latency, or recovery record is claimed.

Activity · repository verification

Claim: signed product events converge into ordered, rebuildable timelines through retry-safe fan-out.

• Public contract: Activity HTTP operation index
• Verified source revision: 103dec9
• Run: formal/feed-core/bin/verify, then cd server && mix test
• Expected result: the formal model completes without an invariant violation and the server suite exits with zero failures

This verifies the repository substrate. It does not prove a downstream production integration, managed availability, or production recovery objectives.

Govern · reference integration verification

Claim: a host event can be revalidated, turned into a bounded proposal, reviewed and executed by the host, then reconciled with lifecycle evidence.

• Public contract: Govern proposal lifecycle
• Verified source revision: e267d2a
• Run: mix tonetify.hanken.golden_smoke, execute the printed Hanken command, then run mix tonetify.hanken.verify_golden_smoke --proposal-id <proposal_id>
• Expected result: Tonetify records proposal delivery and lifecycle reconciliation while Hanken records operator-controlled execution and outcome metrics

Hanken is a reference host, not customer or design-partner evidence. This verification is not a general authority service and does not prove customer deployment or live permit-backed host mutation.

Relay · repository verification

Claim: REST and WebSocket sends share one write path, channel order comes from database-backed seq, and retrying the same channel and nonce returns the same message.

• Public contract: Relay concepts
• Verified source revision: 46abc3b
• Public package: @tonetify/relay@0.1.0-beta.1
• Run: cd server && mix test, then cd ../sdk && npm test -- --run && npm run typecheck && npm run build && npm pack --dry-run
• Expected result: both suites exit with zero failures, and the SDK produces the checked package artifact

This verifies the repository core and package artifact. The public beta artifact is independently readable from npm, but the full verification path is recorded as a repository verification command and expected result unless all repositories and prerequisites are public. It does not prove server compatibility across versions, a supported deployment image, service objectives, or managed availability.

Evidence policy

Scale, availability, latency, and recovery claims stay out of the product surface until a repeatable benchmark or operational record supports them. A proof entry must name the invariant, command, expected result, revision, verification date, and what remains unproven.