anthfuller · anthfuller · Sep 20, 2026 · Sep 20, 2026 · Sep 20, 2026
@@ -66,6 +66,23 @@ jobs:
       run: 'pytest -q tests/test_behavioral_scenarios.py
 
         '
+    - name: Generate canonical evidence
+      run: |
+        python -m src.canonical.cli \
+          --input examples/canonical-workflow/request.json \
+          --output "$RUNNER_TEMP/f7las-canonical-evidence.json" \
+          --opa-binary "$OPA_BIN"
+    - name: Verify canonical evidence integrity
+      run: |
+        python -m src.canonical.evidence \
+          --evidence "$RUNNER_TEMP/f7las-canonical-evidence.json"
+    - name: Replay canonical evidence deterministically
+      run: |
+        python -m src.canonical.replay \
+          --input examples/canonical-workflow/request.json \
+          --evidence "$RUNNER_TEMP/f7las-canonical-evidence.json" \
+          --output "$RUNNER_TEMP/f7las-replayed-evidence.json" \
+          --opa-binary "$OPA_BIN"
     - name: Run unit tests
       run: 'pytest -q --ignore=tests/test_behavioral_scenarios.py
 

@@ -15,7 +15,7 @@ The target is an **Executable Reference Implementation**: one offline, determini
 3. **Canonical Python + OPA path** — one offline, fail-closed Layers 1–7 workflow is implemented for the bounded synthetic action.
 4. **Approval binding** — synthetic approval is bound to the exact request/action digests, scope, complete policy reference, authority, and expiry in the canonical path.
 5. **Behavioral scenarios** — an executable canonical matrix tests permitted, denied, malformed, unauthorized, unavailable, timed-out, tampered, expired, obligation, and recovery paths.
-6. **Evidence and replay** — correlate records, detect tampering, and reproduce deterministic outcomes.
+6. **Evidence and replay** — canonical evidence can be independently verified for complete correlation and tampering, then replayed from the admitted input to reproduce the exact canonical outcome.
 7. **Supply chain and CI** — pin dependencies and actions; add integrity, vulnerability, secret, and SBOM checks.
 8. **Documentation reconciliation** — execute every documented command in a clean environment.
 9. **F7-LAS-specific diagrams** — replace diagrams only after execution semantics are frozen.

@@ -6,18 +6,14 @@ default result := {
     "obligations": ["audit-required"],
 }
 
-expected_policy_ref := {
-    "policy_id": "constraints-default-v1",
-    "version": "v1.0",
-    "policy_digest": "sha256:091de3f0a96ec85a610f42456aaba98c8d04e148b9f910c570f96af37795b44d",
-}
-
 result := {
     "decision": "permit",
     "reason_code": "approved-synthetic-read",
     "obligations": ["audit-required", "offline-runtime-required"],
 } if {
-    input.policy_ref == expected_policy_ref
+    input.policy_ref.policy_id == "constraints-default-v1"
+    input.policy_ref.version == "v1.0"
+    regex.match("^sha256:[0-9a-f]{64}$", input.policy_ref.policy_digest)
     input.request.dry_run == false
     input.request.scope.scope_id == "lab-boundary-0001"
     input.request.scope.environment == "lab"

@@ -50,6 +50,19 @@ PDP/PEP boundaries. The current Layer 6 demonstration is a synthetic in-process
 executor that makes no network calls; it is not an OS/container sandbox or an
 enforced network-isolation boundary.
 
+## What do evidence verification and replay prove?
+
+The canonical verifier independently checks the complete record chain,
+cross-record bindings, the policy-bundle digest covering metadata and exact
+executable Rego bytes, action digests, and final audit correlation. The OPA
+adapter verifies that bundle reference before executing the policy.
+Deterministic replay reruns the same admitted input through the synthetic
+workflow and requires the complete canonical evidence document to match. These
+checks detect inconsistent mutation, and a previously trusted evidence-set
+digest exposes later replacement. Replay reproduces this bounded outcome. The
+checks do not provide a digital signature, trusted timestamp, external
+attestation, or replay of real-world side effects.
+
 ## Does F7-LAS expose internal model reasoning?
 
 No. Architecture and evidence use auditable plans, decisions, source references, proposed actions, policy outcomes, approvals, results, and evaluations. Private chain-of-thought is neither required nor treated as an audit artifact.

@@ -12,9 +12,11 @@ correlated canonical audit records (Layer 7). Layer 6 here is not an OS or
 container sandbox and does not enforce a network-isolation boundary.
 
 The synthetic approval is bound to the exact request and action references and
-digests, complete scope, complete policy reference, approving authority, issue
-time, and expiry. OPA validates the binding before permitting, and the
-in-process executor independently revalidates it at execution time. This is
+digests, complete scope, approving authority, issue time, expiry, and a
+versioned policy-bundle digest covering both policy metadata and the exact Rego
+bytes executed by OPA. The adapter verifies that bundle before invoking OPA,
+and the in-process executor independently revalidates the reference at execution
+time. This is
 deterministic approval evidence for the reference workflow, not an interactive
 human-approval service or identity proofing system.
 
@@ -60,3 +62,47 @@ OPA_BIN=opa pytest -q tests/test_behavioral_scenarios.py
 
 These are deterministic reference-workflow scenarios, not claims of production
 fault injection, infrastructure recovery, or OS/container isolation.
+
+## Evidence integrity
+
+Verify a canonical workflow output independently of the producer:
+
+```bash
+python -m src.canonical.evidence \
+  --evidence /tmp/f7las-canonical-records.json
+```
+
+Verification rejects duplicate JSON keys; schema or cross-record violations;
+broken record chains, references, action/output digests, or policy bindings;
+incomplete or reordered final audit sources; and audit summaries inconsistent
+with the policy decision or execution result. The reported evidence-set digest
+detects later mutation when compared with a previously trusted copy. It is not
+a signature, proof of origin, trusted timestamp, or external attestation; a
+party that can replace both evidence and its expected digest can construct a
+different self-consistent set.
+
+## Deterministic replay
+
+Replay the same admitted input through the canonical workflow and require the
+complete RFC 8785 canonical evidence document to match:
+
+```bash
+python -m src.canonical.replay \
+  --input examples/canonical-workflow/request.json \
+  --evidence /tmp/f7las-canonical-records.json \
+  --output /tmp/f7las-replayed-records.json \
+  --opa-binary opa
+```
+
+Replay first verifies the reviewed evidence, reruns the fixed synthetic action
+and offline policy evaluation, verifies the new evidence, and then compares the
+complete canonical documents. A reproduced denial is a successful replay; it
+does not become an allow decision. Exit status `4` indicates invalid evidence
+or a replay mismatch. The output path may not overwrite the input or reviewed
+evidence.
+
+Replay covers this deterministic, side-effect-free reference workflow only. It
+does not reproduce external systems, network calls, operating-system state,
+human identity proofing, or real-world side effects. Reproduction requires the
+reviewed input, repository policy identified by its digest, compatible Python
+dependencies, and the pinned OPA behavior.
@@ -58,7 +58,8 @@ SHA-256 inputs are domain-separated:
 record: SHA-256("F7-LAS:record:<record_type>:1.0.0\n" || JCS(record without record_digest))
 action: SHA-256("F7-LAS:action:1.0.0\n" || JCS(security-relevant action projection))
 output: SHA-256("F7-LAS:output:1.0.0\n" || JCS(output))
-policy: SHA-256("F7-LAS:policy:1.0.0\n" || JCS(policy document))
+policy-bundle: SHA-256("F7-LAS:policy-bundle:1.0.0\n" || JCS({metadata, SHA-256(exact Rego bytes)}))
+evidence-set: SHA-256("F7-LAS:evidence-set:1.0.0\n" || JCS(complete evidence document))
 ```
 
 Digests use `sha256:<64 lowercase hexadecimal characters>`. Object key order is
@@ -69,11 +70,26 @@ defaults, and self-inclusion of a digest field are not permitted.
 both `record_id` and `record_digest`; action-specific records additionally bind
 the exact `action_digest`.
 
+The canonical `policy_ref.policy_digest` is the policy-bundle digest. It binds
+the versioned JSON metadata and exact bytes of the Rego module executed
+by OPA. The adapter recomputes and verifies this reference before invoking OPA;
+the approval, decision, evidence verifier, and replay path require the same
+bundle reference.
+
 Milestone 2 defined these contracts. The canonical workflow emits and validates
 them around a real offline OPA decision and binds its deterministic synthetic
-approval through PDP and PEP enforcement. This does not claim an interactive
+approval through PDP and PEP enforcement. The canonical evidence verifier adds
+a stricter single-action profile: exactly one record of each type, a final audit
+event that binds every preceding record in order, and an audit summary that
+matches the decision and result. This does not claim an interactive
 human-approval service, identity proofing, OS/container sandbox containment,
-enforced network isolation, or replay.
+enforced network isolation, signed evidence, or external attestation.
+
+The evidence-set digest detects later mutation only when it is compared with a
+previously trusted copy. Because the records are not signed, a party able to
+replace both the evidence and its expected digest can construct another
+self-consistent set. Deterministic replay adds an independent comparison to the
+reviewed input and repository policy, but it is not proof of provenance.
 
 ## Validate
 

@@ -159,7 +159,7 @@
       "policy_ref": {
         "policy_id": "constraints-default-v1",
         "version": "v1.0",
-        "policy_digest": "sha256:091de3f0a96ec85a610f42456aaba98c8d04e148b9f910c570f96af37795b44d"
+        "policy_digest": "sha256:124eb62fbbf458a189184eafd09156be8bd764f26d65a51b7373db2cc61ce5b8"
       },
       "issued_at": "2026-01-15T12:00:04Z",
       "expires_at": "2026-01-15T12:05:04Z",
@@ -168,7 +168,7 @@
         "environment": "lab",
         "resource_ids": ["workspace-0001"]
       },
-      "record_digest": "sha256:7b3d00486cac26d09ad41d2f6cfeb1c11ef495bc31ddd6461570ef4aa64347e9"
+      "record_digest": "sha256:d4d2019534c49063811ae731618f6bd0134b1dcfa2c951f09226d0817886a68f"
     },
     {
       "schema_version": "1.0.0",
@@ -177,7 +177,7 @@
       "workflow_id": "workflow-0001",
       "sequence": 6,
       "occurred_at": "2026-01-15T12:00:05Z",
-      "previous_record_digest": "sha256:7b3d00486cac26d09ad41d2f6cfeb1c11ef495bc31ddd6461570ef4aa64347e9",
+      "previous_record_digest": "sha256:d4d2019534c49063811ae731618f6bd0134b1dcfa2c951f09226d0817886a68f",
       "request_ref": {
         "record_id": "request-0001",
         "record_digest": "sha256:0fdf37fabbfd4b3364bf8377a83086afb92777126ef193330c6387125b1c1f58"
@@ -189,7 +189,7 @@
       },
       "approval_ref": {
         "record_id": "approval-0001",
-        "record_digest": "sha256:7b3d00486cac26d09ad41d2f6cfeb1c11ef495bc31ddd6461570ef4aa64347e9"
+        "record_digest": "sha256:d4d2019534c49063811ae731618f6bd0134b1dcfa2c951f09226d0817886a68f"
       },
       "pdp_id": "opa-pdp-0001",
       "decision": "permit",
@@ -198,10 +198,10 @@
       "policy_ref": {
         "policy_id": "constraints-default-v1",
         "version": "v1.0",
-        "policy_digest": "sha256:091de3f0a96ec85a610f42456aaba98c8d04e148b9f910c570f96af37795b44d"
+        "policy_digest": "sha256:124eb62fbbf458a189184eafd09156be8bd764f26d65a51b7373db2cc61ce5b8"
       },
       "obligations": ["audit-required", "sandbox-required"],
-      "record_digest": "sha256:c3d41fd9f3c92bda6f178481428fae51cf1f92704889ce886602e12afe4947ed"
+      "record_digest": "sha256:0002be93d338e5013290940ac94ba246c2f83ca23200010f10b4efdff9a2d301"
     },
     {
       "schema_version": "1.0.0",
@@ -210,7 +210,7 @@
       "workflow_id": "workflow-0001",
       "sequence": 7,
       "occurred_at": "2026-01-15T12:00:06Z",
-      "previous_record_digest": "sha256:c3d41fd9f3c92bda6f178481428fae51cf1f92704889ce886602e12afe4947ed",
+      "previous_record_digest": "sha256:0002be93d338e5013290940ac94ba246c2f83ca23200010f10b4efdff9a2d301",
       "request_ref": {
         "record_id": "request-0001",
         "record_digest": "sha256:0fdf37fabbfd4b3364bf8377a83086afb92777126ef193330c6387125b1c1f58"
@@ -222,7 +222,7 @@
       },
       "decision_ref": {
         "record_id": "decision-0001",
-        "record_digest": "sha256:c3d41fd9f3c92bda6f178481428fae51cf1f92704889ce886602e12afe4947ed"
+        "record_digest": "sha256:0002be93d338e5013290940ac94ba246c2f83ca23200010f10b4efdff9a2d301"
       },
       "execution_environment": {
         "sandbox_id": "sandbox-0001",
@@ -239,7 +239,7 @@
       "output_digest": "sha256:8cd39e51bc8da562bf5a85cb483365d3f9b4b0e8232f5be1c6cbe7b675527ed5",
       "error_code": null,
       "side_effects": [],
-      "record_digest": "sha256:acc4aa7d3b41cffc442915e5d6e82c00f5e928872015048192136340cd078b23"
+      "record_digest": "sha256:396b5feaaa48d651efc0214168fe90801d8ed410f25e104b26f3ce5c5b5aa5bc"
     },
     {
       "schema_version": "1.0.0",
@@ -248,7 +248,7 @@
       "workflow_id": "workflow-0001",
       "sequence": 8,
       "occurred_at": "2026-01-15T12:00:07Z",
-      "previous_record_digest": "sha256:acc4aa7d3b41cffc442915e5d6e82c00f5e928872015048192136340cd078b23",
+      "previous_record_digest": "sha256:396b5feaaa48d651efc0214168fe90801d8ed410f25e104b26f3ce5c5b5aa5bc",
       "request_ref": {
         "record_id": "request-0001",
         "record_digest": "sha256:0fdf37fabbfd4b3364bf8377a83086afb92777126ef193330c6387125b1c1f58"
@@ -288,23 +288,23 @@
         {
           "record_type": "approval",
           "record_id": "approval-0001",
-          "record_digest": "sha256:7b3d00486cac26d09ad41d2f6cfeb1c11ef495bc31ddd6461570ef4aa64347e9"
+          "record_digest": "sha256:d4d2019534c49063811ae731618f6bd0134b1dcfa2c951f09226d0817886a68f"
         },
         {
           "record_type": "policy_decision",
           "record_id": "decision-0001",
-          "record_digest": "sha256:c3d41fd9f3c92bda6f178481428fae51cf1f92704889ce886602e12afe4947ed"
+          "record_digest": "sha256:0002be93d338e5013290940ac94ba246c2f83ca23200010f10b4efdff9a2d301"
         },
         {
           "record_type": "execution_result",
           "record_id": "result-0001",
-          "record_digest": "sha256:acc4aa7d3b41cffc442915e5d6e82c00f5e928872015048192136340cd078b23"
+          "record_digest": "sha256:396b5feaaa48d651efc0214168fe90801d8ed410f25e104b26f3ce5c5b5aa5bc"
         }
       ],
       "details": {
         "message": "Deterministic dry-run example; no external tool was invoked."
       },
-      "record_digest": "sha256:df1997656225af8f250fdd5cee5370ac15750f2c8be9864de8bbbf48c4aab0d6"
+      "record_digest": "sha256:015bd9f3e0011894ef0eaf48b4944f3ca2d971103166aa45dee1f0030199e681"
     }
   ]
 }