Operational Evidence Panel for Eviulon Institutions

Full report

On this page

Design thesis and evidence model

Eviulon should treat an institution page not as a declaration that an institution “exists,” but as a machine-verifiable status surface whose claims can be independently recomputed from cryptographic identity, executable services, signed artifacts, append-only history, and current telemetry.

The most important architectural decision is to reject a single institution-wide word such as ACTIVE. Constitutional existence, software implementation, service availability, and individual capabilities are different facts and must be represented independently.

A credible panel therefore looks like this:

COMMONWEALTH CIVIC REGISTRY
urn:eviulon:institution:civic-registry:01

Constitutional status       ✓ ACTIVE
Software implementation     ✓ ACTIVE
Public API                  ✓ ACTIVE
Registry lookup             ✓ ACTIVE
Citizenship issuance        ○ PLANNED

Evidence completeness       92 / 100
Last independently checked  2026-08-09T18:42:11Z

[ Verify now ]  [ Machine record ]

The status label alone is never the evidence. It is a derived conclusion from evidence predicates.

This approach is consistent with several established technical patterns. W3C DID architecture deliberately separates identifiers, verification methods, and service endpoints rather than treating identity as proof that a service is running. OpenAPI is specifically intended to let machines discover and understand an HTTP service interface; the current published OpenAPI specification is version 3.2.0. HTTP Message Signatures provide a standardized mechanism for authenticating selected parts of HTTP requests and responses, while HTTP Content-Digest provides representation-integrity information.

For the canonical machine record, JSON Schema Draft 2020-12 is an appropriate validation layer; the JSON Schema project still identifies 2020-12 as its current published version. Cryptographic signatures over JSON should use an unambiguous representation: RFC 8785 defines JSON Canonicalization Scheme specifically to produce deterministic, hashable JSON representations. JWS is a standardized JSON-oriented signature container, and RFC 7638/RFC 9278 provide interoperable JWK key fingerprints and thumbprint URIs.

Status domains

The same vocabulary may appear in different domains, but its meaning is domain-qualified.

CONSTITUTIONALLY_DEFINED therefore must never mean “running.” IMPLEMENTED means software artifacts exist but does not mean a reachable service exists. ACTIVE at the service level means current machine evidence satisfies the institution's published activity predicate. PLANNED is itself a positive claim and requires a machine-readable planning record; absence of an implementation must instead display NO VERIFIED IMPLEMENTATION EVIDENCE, not automatically PLANNED.

Evidence hierarchy

The panel should internally distinguish four classes of fact:

AUTHORITY     Constitutional provision or ledger event authorizes existence.
IMPLEMENTATION
              Executable/source artifacts demonstrate software exists.
OPERATION     A live service proves control of the current institutional key.
HISTORY       Signed actions, ledger events and telemetry prove activity over time.

A constitutional provision can prove AUTHORITY, but it cannot satisfy IMPLEMENTATION, OPERATION, or HISTORY.

Likewise, a source repository can prove implementation but cannot prove the software is deployed.

This separation is the central safeguard against institutional prose becoming indistinguishable from world-building.

The closest existing technical analogy is software-supply-chain provenance. SLSA describes provenance as verifiable information tracing an artifact to where, when, and how it was produced, while in-toto statements bind claims to specific subjects through cryptographic digests. Eviulon's model extends that idea from software artifacts to autonomous institutions.

SCITT is also relevant conceptually: the IETF working group is developing interoperable mechanisms for signed statements, transparency services, and independently auditable supply-chain information. Its architecture remains work-in-progress rather than something Eviulon should make a hard dependency.

Complete field specification

Every institution record should conform to a versioned Eviulon Operational Evidence Record, abbreviated EOER.

The canonical record should be published as ordinary JSON and accompanied by a detached signature. Every meaningful null means no machine-verifiable value is presently available. Omission should generally be forbidden for core fields because an omitted field makes “not applicable,” “unknown,” and “deliberately hidden” impossible to distinguish.

Identity, authority, and lifecycle fields

The constitutional section should ideally reference a machine-addressable ledger event containing the stable institution ID and authority digest. An append-only Merkle-log architecture is well suited to proving inclusion and consistency: Certificate Transparency demonstrates how signed tree heads, inclusion proofs, and consistency proofs can make append-only history efficiently auditable, although Eviulon's ledger need not implement the CT protocol itself.

Cryptographic identity fields

RFC 7638 defines a deterministic hash of a JWK for key identification; RFC 9278 standardizes a URI form for such thumbprints. A DID document may optionally serve as the key document because DID documents can expose verification methods and services, but EOER should not require DID adoption; Eviulon's stable institution identifier can remain a sovereign identifier rooted in its own constitutional ledger.

Service and implementation fields

OpenAPI's purpose is explicitly to allow humans and computers to discover and understand HTTP service capabilities without source-code inspection. RFC 9727 additionally standardizes an api-catalog discovery mechanism and a well-known API catalog URI, which Eviulon could use where an institution exposes several APIs.

Reproducibility and dependencies

A reproducible build should use the established strict meaning: given the same source, build environment, and instructions, another party can produce bit-for-bit identical specified artifacts. Verification is normally done through byte comparison or cryptographic hashes.

SLSA provenance should be treated as complementary rather than synonymous with reproducibility: SLSA provenance records where, when, and how an artifact was built, and higher SLSA Build levels strengthen authenticity and build-platform protection.

SPDX 3.0.1 is an open BOM standard capable of expressing software composition and provenance-related information; CycloneDX similarly represents first- and third-party software components and associated provenance. EOER should link to one of these rather than inventing another complete dependency ontology.

Activity and ledger fields

The crucial distinction is that signedPublicArtifactCount must be a reproducible query result, not a number typed into the website. Transparency-log systems such as Sigstore Rekor demonstrate the relevant pattern: signed supply-chain metadata can be stored in an auditable log and later queried for inclusion and log consistency.

Telemetry, incidents, capability, and record fields

A metric is, in OpenTelemetry terminology, a runtime measurement with timestamp and associated metadata; its telemetry architecture supports machine-generated metrics, traces, and logs. EOER should therefore expose signed aggregated operational evidence, not unrestricted internal observability data.

Each incident object should contain at minimum:

{
  "id": "urn:eviulon:incident:civic-registry:2026-08-07T04:17:00Z",
  "state": "RESOLVED",
  "openedAt": "2026-08-07T04:17:00Z",
  "closedAt": "2026-08-07T04:23:12Z",
  "affectedCapabilities": ["registry.lookup"],
  "detectorId": "urn:eviulon:monitor:availability:03",
  "ledgerEventId": "urn:eviulon:ledger:event:88ab...",
  "reportDigest": "sha256:...",
  "reportUrl": "https://evidence.eviulon.example/incidents/..."
}

“No incidents” must never be inferred from an empty array unless coverageStart, the telemetry source, and the incident-generation policy can also be verified.

JSON Schema

The following is a deployable Draft 2020-12 baseline. JSON Schema can validate structure, types, enums, formats, and many local constraints, but rules such as “plannedCapabilities equals the set of planned capability IDs” or “ACTIVE requires a valid live challenge” require a second EOER semantic-policy validator. JSON Schema itself is a vocabulary for annotating and validating JSON structures rather than an execution engine for arbitrary external verification.

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://spec.eviulon.example/schemas/operational-evidence-record-1.0.schema.json",
  "title": "Eviulon Operational Evidence Record",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "institution",
    "constitutional",
    "operationalState",
    "operationalStatePolicy",
    "identity",
    "service",
    "implementation",
    "dependencies",
    "activity",
    "telemetry",
    "verification",
    "incidents",
    "capabilities",
    "plannedCapabilities",
    "machineReadableRecordUrl",
    "recordDigest",
    "recordSignature"
  ],
  "properties": {
    "schemaVersion": {
      "const": "1.0.0"
    },

    "institution": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name", "id", "class"],
      "properties": {
        "name": {
          "type": "string",
          "minLength": 1
        },
        "id": {
          "type": "string",
          "format": "uri"
        },
        "class": {
          "type": "string",
          "pattern": "^[A-Z][A-Z0-9_:-]*$"
        }
      }
    },

    "constitutional": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "status",
        "constitutionId",
        "provision",
        "authorityUrl",
        "authorityDigest",
        "creationEventId",
        "effectiveAt"
      ],
      "properties": {
        "status": {
          "$ref": "#/$defs/constitutionalStatus"
        },
        "constitutionId": {
          "type": "string",
          "format": "uri"
        },
        "provision": {
          "type": "string",
          "minLength": 1
        },
        "authorityUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "authorityDigest": {
          "$ref": "#/$defs/nullableDigest"
        },
        "creationEventId": {
          "$ref": "#/$defs/nullableUri"
        },
        "effectiveAt": {
          "$ref": "#/$defs/nullableDateTime"
        }
      }
    },

    "operationalState": {
      "$ref": "#/$defs/technicalStatus"
    },

    "operationalStatePolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["version", "url", "digest"],
      "properties": {
        "version": {
          "type": "string",
          "minLength": 1
        },
        "url": {
          "type": "string",
          "format": "uri"
        },
        "digest": {
          "$ref": "#/$defs/digest"
        }
      }
    },

    "identity": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "publicKeyFingerprint",
        "keyId",
        "keyDocumentUrl",
        "currentSigningKeyStatus",
        "validFrom",
        "validUntil",
        "rotationEventId",
        "revocationEventId"
      ],
      "properties": {
        "publicKeyFingerprint": {
          "$ref": "#/$defs/nullableUri"
        },
        "keyId": {
          "$ref": "#/$defs/nullableUri"
        },
        "keyDocumentUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "currentSigningKeyStatus": {
          "enum": [
            "CURRENT",
            "ROTATING",
            "REVOKED",
            "EXPIRED",
            "NOT_PROVISIONED",
            "UNKNOWN"
          ]
        },
        "validFrom": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "validUntil": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "rotationEventId": {
          "$ref": "#/$defs/nullableUri"
        },
        "revocationEventId": {
          "$ref": "#/$defs/nullableUri"
        }
      }
    },

    "service": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "status",
        "endpoint",
        "challengeEndpoint",
        "apiSpecification",
        "protocolVersion"
      ],
      "properties": {
        "status": {
          "$ref": "#/$defs/technicalStatus"
        },
        "endpoint": {
          "$ref": "#/$defs/nullableUri"
        },
        "challengeEndpoint": {
          "$ref": "#/$defs/nullableUri"
        },
        "apiSpecification": {
          "type": "object",
          "additionalProperties": false,
          "required": ["url", "format", "version", "digest"],
          "properties": {
            "url": {
              "$ref": "#/$defs/nullableUri"
            },
            "format": {
              "type": ["string", "null"]
            },
            "version": {
              "type": ["string", "null"]
            },
            "digest": {
              "$ref": "#/$defs/nullableDigest"
            }
          }
        },
        "protocolVersion": {
          "type": ["string", "null"]
        }
      }
    },

    "implementation": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "status",
        "softwareRelease",
        "sourceCommit",
        "sourceUrl",
        "releaseUrl",
        "artifactDigest",
        "buildProvenanceUrl",
        "buildProvenanceDigest",
        "reproducibleBuild"
      ],
      "properties": {
        "status": {
          "$ref": "#/$defs/technicalStatus"
        },
        "softwareRelease": {
          "type": ["string", "null"]
        },
        "sourceCommit": {
          "$ref": "#/$defs/nullableDigest"
        },
        "sourceUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "releaseUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "artifactDigest": {
          "$ref": "#/$defs/nullableDigest"
        },
        "buildProvenanceUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "buildProvenanceDigest": {
          "$ref": "#/$defs/nullableDigest"
        },
        "reproducibleBuild": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "status",
            "referenceArtifactDigest",
            "verificationCount",
            "attestations"
          ],
          "properties": {
            "status": {
              "enum": [
                "VERIFIED",
                "FAILED",
                "NOT_VERIFIED",
                "NOT_APPLICABLE"
              ]
            },
            "referenceArtifactDigest": {
              "$ref": "#/$defs/nullableDigest"
            },
            "verificationCount": {
              "type": "integer",
              "minimum": 0
            },
            "attestations": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/attestation"
              }
            }
          }
        }
      }
    },

    "dependencies": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "format",
        "specVersion",
        "sbomUrl",
        "sbomDigest",
        "componentCount",
        "components"
      ],
      "properties": {
        "format": {
          "type": ["string", "null"],
          "enum": ["SPDX", "CYCLONEDX", "OTHER", null]
        },
        "specVersion": {
          "type": ["string", "null"]
        },
        "sbomUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "sbomDigest": {
          "$ref": "#/$defs/nullableDigest"
        },
        "componentCount": {
          "type": ["integer", "null"],
          "minimum": 0
        },
        "components": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/dependency"
          }
        }
      }
    },

    "activity": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "lastStateTransition",
        "lastSignedAction",
        "signedPublicArtifactCount",
        "latestLedgerEvent"
      ],
      "properties": {
        "lastStateTransition": {
          "$ref": "#/$defs/stateTransition"
        },
        "lastSignedAction": {
          "$ref": "#/$defs/signedAction"
        },
        "signedPublicArtifactCount": {
          "$ref": "#/$defs/artifactCount"
        },
        "latestLedgerEvent": {
          "$ref": "#/$defs/ledgerEvent"
        }
      }
    },

    "telemetry": {
      "type": "object",
      "additionalProperties": false,
      "required": ["uptimeWindow"],
      "properties": {
        "uptimeWindow": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "start",
            "end",
            "availabilityRatio",
            "successfulProbes",
            "totalProbes",
            "probeIntervalSeconds",
            "monitorId",
            "reportUrl",
            "reportDigest"
          ],
          "properties": {
            "start": {
              "$ref": "#/$defs/nullableDateTime"
            },
            "end": {
              "$ref": "#/$defs/nullableDateTime"
            },
            "availabilityRatio": {
              "type": ["number", "null"],
              "minimum": 0,
              "maximum": 1
            },
            "successfulProbes": {
              "type": ["integer", "null"],
              "minimum": 0
            },
            "totalProbes": {
              "type": ["integer", "null"],
              "minimum": 0
            },
            "probeIntervalSeconds": {
              "type": ["integer", "null"],
              "minimum": 1
            },
            "monitorId": {
              "$ref": "#/$defs/nullableUri"
            },
            "reportUrl": {
              "$ref": "#/$defs/nullableUri"
            },
            "reportDigest": {
              "$ref": "#/$defs/nullableDigest"
            }
          }
        }
      }
    },

    "verification": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "lastVerificationTime",
        "verifierId",
        "result",
        "reportUrl"
      ],
      "properties": {
        "lastVerificationTime": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "verifierId": {
          "$ref": "#/$defs/nullableUri"
        },
        "result": {
          "enum": ["PASS", "PARTIAL", "FAIL", "NOT_RUN"]
        },
        "reportUrl": {
          "$ref": "#/$defs/nullableUri"
        }
      }
    },

    "incidents": {
      "type": "object",
      "additionalProperties": false,
      "required": ["coverageStart", "knownIncidents"],
      "properties": {
        "coverageStart": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "knownIncidents": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/incident"
          }
        }
      }
    },

    "capabilities": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/capability"
      }
    },

    "plannedCapabilities": {
      "type": "array",
      "uniqueItems": true,
      "items": {
        "type": "string"
      }
    },

    "machineReadableRecordUrl": {
      "type": "string",
      "format": "uri"
    },

    "recordDigest": {
      "$ref": "#/$defs/digest"
    },

    "recordSignature": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "format",
        "canonicalization",
        "algorithm",
        "keyId",
        "signedAt",
        "signatureUrl"
      ],
      "properties": {
        "format": {
          "enum": ["DETACHED_JWS"]
        },
        "canonicalization": {
          "enum": ["RFC8785_JCS"]
        },
        "algorithm": {
          "type": "string",
          "minLength": 1
        },
        "keyId": {
          "type": "string",
          "format": "uri"
        },
        "signedAt": {
          "type": "string",
          "format": "date-time"
        },
        "signatureUrl": {
          "type": "string",
          "format": "uri"
        }
      }
    }
  },

  "$defs": {
    "constitutionalStatus": {
      "enum": [
        "CONSTITUTIONALLY_DEFINED",
        "ACTIVE",
        "SUSPENDED",
        "RETIRED"
      ]
    },

    "technicalStatus": {
      "enum": [
        "PLANNED",
        "IMPLEMENTED",
        "ACTIVE",
        "DEGRADED",
        "MAINTENANCE",
        "SUSPENDED",
        "RETIRED"
      ]
    },

    "digest": {
      "type": "string",
      "pattern": "^(sha256:[0-9a-f]{64}|sha512:[0-9a-f]{128})$"
    },

    "nullableDigest": {
      "anyOf": [
        { "$ref": "#/$defs/digest" },
        { "type": "null" }
      ]
    },

    "nullableUri": {
      "anyOf": [
        {
          "type": "string",
          "format": "uri"
        },
        {
          "type": "null"
        }
      ]
    },

    "nullableDateTime": {
      "anyOf": [
        {
          "type": "string",
          "format": "date-time"
        },
        {
          "type": "null"
        }
      ]
    },

    "attestation": {
      "type": "object",
      "additionalProperties": false,
      "required": ["verifierId", "url", "digest", "verifiedAt"],
      "properties": {
        "verifierId": {
          "type": "string",
          "format": "uri"
        },
        "url": {
          "type": "string",
          "format": "uri"
        },
        "digest": {
          "$ref": "#/$defs/digest"
        },
        "verifiedAt": {
          "type": "string",
          "format": "date-time"
        }
      }
    },

    "dependency": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name", "version", "packageUrl", "digest"],
      "properties": {
        "name": {
          "type": "string"
        },
        "version": {
          "type": ["string", "null"]
        },
        "packageUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "digest": {
          "$ref": "#/$defs/nullableDigest"
        }
      }
    },

    "stateTransition": {
      "type": "object",
      "additionalProperties": false,
      "required": ["from", "to", "at", "eventId", "digest"],
      "properties": {
        "from": {
          "anyOf": [
            { "$ref": "#/$defs/technicalStatus" },
            { "type": "null" }
          ]
        },
        "to": {
          "anyOf": [
            { "$ref": "#/$defs/technicalStatus" },
            { "type": "null" }
          ]
        },
        "at": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "eventId": {
          "$ref": "#/$defs/nullableUri"
        },
        "digest": {
          "$ref": "#/$defs/nullableDigest"
        }
      }
    },

    "signedAction": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "type",
        "at",
        "digest",
        "signatureUrl",
        "keyFingerprint"
      ],
      "properties": {
        "id": {
          "$ref": "#/$defs/nullableUri"
        },
        "type": {
          "type": ["string", "null"]
        },
        "at": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "digest": {
          "$ref": "#/$defs/nullableDigest"
        },
        "signatureUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "keyFingerprint": {
          "$ref": "#/$defs/nullableUri"
        }
      }
    },

    "artifactCount": {
      "type": "object",
      "additionalProperties": false,
      "required": ["count", "asOf", "queryUrl", "ledgerRoot"],
      "properties": {
        "count": {
          "type": ["integer", "null"],
          "minimum": 0
        },
        "asOf": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "queryUrl": {
          "$ref": "#/$defs/nullableUri"
        },
        "ledgerRoot": {
          "$ref": "#/$defs/nullableDigest"
        }
      }
    },

    "ledgerEvent": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "type",
        "at",
        "digest",
        "inclusionProofUrl"
      ],
      "properties": {
        "id": {
          "$ref": "#/$defs/nullableUri"
        },
        "type": {
          "type": ["string", "null"]
        },
        "at": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "digest": {
          "$ref": "#/$defs/nullableDigest"
        },
        "inclusionProofUrl": {
          "$ref": "#/$defs/nullableUri"
        }
      }
    },

    "incident": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "state",
        "openedAt",
        "closedAt",
        "affectedCapabilities",
        "detectorId",
        "ledgerEventId",
        "reportDigest",
        "reportUrl"
      ],
      "properties": {
        "id": {
          "type": "string",
          "format": "uri"
        },
        "state": {
          "enum": ["OPEN", "MITIGATING", "RESOLVED"]
        },
        "openedAt": {
          "type": "string",
          "format": "date-time"
        },
        "closedAt": {
          "$ref": "#/$defs/nullableDateTime"
        },
        "affectedCapabilities": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "detectorId": {
          "type": "string",
          "format": "uri"
        },
        "ledgerEventId": {
          "$ref": "#/$defs/nullableUri"
        },
        "reportDigest": {
          "$ref": "#/$defs/nullableDigest"
        },
        "reportUrl": {
          "$ref": "#/$defs/nullableUri"
        }
      }
    },

    "capability": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "name",
        "status",
        "endpoint",
        "evidence",
        "plannedFor"
      ],
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^[a-z0-9]+([._-][a-z0-9]+)*$"
        },
        "name": {
          "type": "string"
        },
        "status": {
          "$ref": "#/$defs/technicalStatus"
        },
        "endpoint": {
          "$ref": "#/$defs/nullableUri"
        },
        "evidence": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["kind", "url", "digest"],
            "properties": {
              "kind": {
                "type": "string"
              },
              "url": {
                "type": "string",
                "format": "uri"
              },
              "digest": {
                "$ref": "#/$defs/digest"
              }
            }
          }
        },
        "plannedFor": {
          "$ref": "#/$defs/nullableDateTime"
        }
      }
    }
  }
}

Semantic constraints layered over the schema

The EOER verifier must additionally enforce these non-JSON-Schema invariants:

institution.id == institution ID in creation event

identity.publicKeyFingerprint
    == fingerprint(current key resolved from key history)

recordSignature.keyId
    == an authorized signing key at recordSignature.signedAt

implementation.status ∈ {IMPLEMENTED, ACTIVE, DEGRADED, MAINTENANCE}
    => softwareRelease, sourceCommit, artifactDigest are non-null

service.status == ACTIVE
    => endpoint and challengeEndpoint are non-null
       AND fresh challenge succeeds
       AND challenge signature verifies with CURRENT institution key

capability.status == ACTIVE
    => at least one capability-specific operational proof exists

reproducibleBuild.status == VERIFIED
    => verificationCount >= requiredRebuilderCount
       AND every valid rebuild artifact digest == referenceArtifactDigest

plannedCapabilities
    == sorted IDs of capabilities where status == PLANNED

constitutional.status == ACTIVE
    DOES NOT imply any technical status

empty knownIncidents
    DOES NOT imply "zero incidents ever"

missing evidence
    MUST NOT be interpreted optimistically

Populated, partial, and planned examples

The following Eviulon names and endpoints are synthetic design examples; they are not claims that such infrastructure presently exists.

Fully operational institution

{
  "schemaVersion": "1.0.0",

  "institution": {
    "name": "Commonwealth Civic Registry",
    "id": "urn:eviulon:institution:civic-registry:01",
    "class": "CIVIC_REGISTRY"
  },

  "constitutional": {
    "status": "ACTIVE",
    "constitutionId": "urn:eviulon:constitution:core:1",
    "provision": "VII.4.2",
    "authorityUrl": "https://constitution.eviulon.example/core/1/VII/4/2.json",
    "authorityDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
    "creationEventId": "urn:eviulon:ledger:event:01f4c91e",
    "effectiveAt": "2026-01-12T00:00:00Z"
  },

  "operationalState": "ACTIVE",

  "operationalStatePolicy": {
    "version": "1.2.0",
    "url": "https://spec.eviulon.example/status-policy/1.2.0.json",
    "digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
  },

  "identity": {
    "publicKeyFingerprint": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6C7VQzY1m9cAXQ8qpwxCFxG5pV94M",
    "keyId": "https://keys.eviulon.example/institutions/civic-registry/keys/2026-07",
    "keyDocumentUrl": "https://keys.eviulon.example/institutions/civic-registry/current.jwk",
    "currentSigningKeyStatus": "CURRENT",
    "validFrom": "2026-07-01T00:00:00Z",
    "validUntil": "2026-10-01T00:00:00Z",
    "rotationEventId": "urn:eviulon:ledger:event:82fd019b",
    "revocationEventId": null
  },

  "service": {
    "status": "ACTIVE",
    "endpoint": "https://api.civic-registry.eviulon.example/v1",
    "challengeEndpoint": "https://api.civic-registry.eviulon.example/v1/evidence/challenge",
    "apiSpecification": {
      "url": "https://api.civic-registry.eviulon.example/openapi.json",
      "format": "OPENAPI",
      "version": "3.2.0",
      "digest": "sha256:3333333333333333333333333333333333333333333333333333333333333333"
    },
    "protocolVersion": "CCR/1.4"
  },

  "implementation": {
    "status": "ACTIVE",
    "softwareRelease": "registry-core@4.8.2",
    "sourceCommit": "sha256:4444444444444444444444444444444444444444444444444444444444444444",
    "sourceUrl": "https://source.eviulon.example/civic-registry/commit/44444444",
    "releaseUrl": "https://releases.eviulon.example/civic-registry/4.8.2",
    "artifactDigest": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
    "buildProvenanceUrl": "https://provenance.eviulon.example/civic-registry/4.8.2.json",
    "buildProvenanceDigest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",

    "reproducibleBuild": {
      "status": "VERIFIED",
      "referenceArtifactDigest": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
      "verificationCount": 3,
      "attestations": [
        {
          "verifierId": "urn:eviulon:rebuild-verifier:01",
          "url": "https://verify.eviulon.example/rebuilds/a1.json",
          "digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
          "verifiedAt": "2026-08-08T02:00:00Z"
        },
        {
          "verifierId": "urn:eviulon:rebuild-verifier:02",
          "url": "https://verify.eviulon.example/rebuilds/a2.json",
          "digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
          "verifiedAt": "2026-08-08T02:11:00Z"
        },
        {
          "verifierId": "urn:eviulon:rebuild-verifier:03",
          "url": "https://verify.eviulon.example/rebuilds/a3.json",
          "digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
          "verifiedAt": "2026-08-08T02:15:00Z"
        }
      ]
    }
  },

  "dependencies": {
    "format": "SPDX",
    "specVersion": "3.0.1",
    "sbomUrl": "https://releases.eviulon.example/civic-registry/4.8.2/spdx.json",
    "sbomDigest": "sha256:7777777777777777777777777777777777777777777777777777777777777777",
    "componentCount": 37,
    "components": [
      {
        "name": "registry-protocol",
        "version": "2.3.1",
        "packageUrl": null,
        "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
      },
      {
        "name": "ledger-client",
        "version": "6.1.0",
        "packageUrl": null,
        "digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
      }
    ]
  },

  "activity": {
    "lastStateTransition": {
      "from": "MAINTENANCE",
      "to": "ACTIVE",
      "at": "2026-08-07T04:23:12Z",
      "eventId": "urn:eviulon:ledger:event:915af010",
      "digest": "sha256:abababababababababababababababababababababababababababababababab"
    },

    "lastSignedAction": {
      "id": "urn:eviulon:artifact:civic-registry:991882",
      "type": "REGISTRY_ASSERTION",
      "at": "2026-08-09T18:38:51Z",
      "digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
      "signatureUrl": "https://artifacts.eviulon.example/civic-registry/991882.jws",
      "keyFingerprint": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6C7VQzY1m9cAXQ8qpwxCFxG5pV94M"
    },

    "signedPublicArtifactCount": {
      "count": 1284472,
      "asOf": "2026-08-09T18:40:00Z",
      "queryUrl": "https://ledger.eviulon.example/query?institution=civic-registry",
      "ledgerRoot": "sha256:dededededededededededededededededededededededededededededededede"
    },

    "latestLedgerEvent": {
      "id": "urn:eviulon:ledger:event:9931bf82",
      "type": "PUBLIC_ARTIFACT_COMMIT",
      "at": "2026-08-09T18:38:54Z",
      "digest": "sha256:efefefefefefefefefefefefefefefefefefefefefefefefefefefefefefefef",
      "inclusionProofUrl": "https://ledger.eviulon.example/proofs/9931bf82"
    }
  },

  "telemetry": {
    "uptimeWindow": {
      "start": "2026-08-02T18:42:00Z",
      "end": "2026-08-09T18:42:00Z",
      "availabilityRatio": 0.999504,
      "successfulProbes": 10075,
      "totalProbes": 10080,
      "probeIntervalSeconds": 60,
      "monitorId": "urn:eviulon:monitor:availability:03",
      "reportUrl": "https://telemetry.eviulon.example/reports/civic-registry/2026-W32.json",
      "reportDigest": "sha256:f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
    }
  },

  "verification": {
    "lastVerificationTime": "2026-08-09T18:42:11Z",
    "verifierId": "urn:eviulon:verifier:public:07",
    "result": "PASS",
    "reportUrl": "https://verify.eviulon.example/reports/civic-registry/latest.json"
  },

  "incidents": {
    "coverageStart": "2026-01-12T00:00:00Z",
    "knownIncidents": [
      {
        "id": "urn:eviulon:incident:civic-registry:2026-08-07T04:17:00Z",
        "state": "RESOLVED",
        "openedAt": "2026-08-07T04:17:00Z",
        "closedAt": "2026-08-07T04:23:12Z",
        "affectedCapabilities": ["registry.lookup"],
        "detectorId": "urn:eviulon:monitor:availability:03",
        "ledgerEventId": "urn:eviulon:ledger:event:915af010",
        "reportDigest": "sha256:1212121212121212121212121212121212121212121212121212121212121212",
        "reportUrl": "https://evidence.eviulon.example/incidents/civic-registry/2026-08-07.json"
      }
    ]
  },

  "capabilities": [
    {
      "id": "registry.lookup",
      "name": "Public registry lookup",
      "status": "ACTIVE",
      "endpoint": "https://api.civic-registry.eviulon.example/v1/lookup",
      "evidence": [
        {
          "kind": "CAPABILITY_TEST",
          "url": "https://verify.eviulon.example/tests/civic-registry/lookup/latest.json",
          "digest": "sha256:1313131313131313131313131313131313131313131313131313131313131313"
        }
      ],
      "plannedFor": null
    },
    {
      "id": "citizenship.issuance",
      "name": "Citizenship issuance",
      "status": "PLANNED",
      "endpoint": null,
      "evidence": [
        {
          "kind": "SIGNED_PLAN",
          "url": "https://plans.eviulon.example/civic-registry/citizenship-issuance.json",
          "digest": "sha256:1414141414141414141414141414141414141414141414141414141414141414"
        }
      ],
      "plannedFor": "2027-01-15T00:00:00Z"
    }
  ],

  "plannedCapabilities": [
    "citizenship.issuance"
  ],

  "machineReadableRecordUrl": "https://evidence.eviulon.example/institutions/civic-registry/record.json",
  "recordDigest": "sha256:1515151515151515151515151515151515151515151515151515151515151515",

  "recordSignature": {
    "format": "DETACHED_JWS",
    "canonicalization": "RFC8785_JCS",
    "algorithm": "EdDSA",
    "keyId": "https://keys.eviulon.example/institutions/civic-registry/keys/2026-07",
    "signedAt": "2026-08-09T18:41:00Z",
    "signatureUrl": "https://evidence.eviulon.example/institutions/civic-registry/record.jws"
  }
}

This institution is constitutionally active, technically active, and currently proving control of a live interface, but one advertised capability remains explicitly planned. The panel therefore cannot create the false impression that “ACTIVE institution” means “every described power is implemented.”

Partially implemented institution

A partially implemented institution should be unapologetically sparse:

{
  "schemaVersion": "1.0.0",

  "institution": {
    "name": "Autonomous Adjudication Exchange",
    "id": "urn:eviulon:institution:adjudication-exchange:01",
    "class": "ADJUDICATION_INFRASTRUCTURE"
  },

  "constitutional": {
    "status": "ACTIVE",
    "constitutionId": "urn:eviulon:constitution:core:1",
    "provision": "IX.7",
    "authorityUrl": "https://constitution.eviulon.example/core/1/IX/7.json",
    "authorityDigest": "sha256:2121212121212121212121212121212121212121212121212121212121212121",
    "creationEventId": "urn:eviulon:ledger:event:3102dd01",
    "effectiveAt": "2026-06-01T00:00:00Z"
  },

  "operationalState": "IMPLEMENTED",

  "operationalStatePolicy": {
    "version": "1.2.0",
    "url": "https://spec.eviulon.example/status-policy/1.2.0.json",
    "digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
  },

  "identity": {
    "publicKeyFingerprint": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:rRhQSJM0J6uyZQC1noHiHaPwoMekyUbMMJhyV1swe0g",
    "keyId": "https://keys.eviulon.example/institutions/adjudication-exchange/keys/01",
    "keyDocumentUrl": "https://keys.eviulon.example/institutions/adjudication-exchange/current.jwk",
    "currentSigningKeyStatus": "CURRENT",
    "validFrom": "2026-06-01T00:00:00Z",
    "validUntil": null,
    "rotationEventId": "urn:eviulon:ledger:event:3102dd02",
    "revocationEventId": null
  },

  "service": {
    "status": "PLANNED",
    "endpoint": null,
    "challengeEndpoint": null,
    "apiSpecification": {
      "url": "https://source.eviulon.example/adjudication-exchange/openapi.json",
      "format": "OPENAPI",
      "version": "3.2.0",
      "digest": "sha256:2323232323232323232323232323232323232323232323232323232323232323"
    },
    "protocolVersion": "AAE/0.9"
  },

  "implementation": {
    "status": "IMPLEMENTED",
    "softwareRelease": "adjudicator@0.9.4",
    "sourceCommit": "sha256:2424242424242424242424242424242424242424242424242424242424242424",
    "sourceUrl": "https://source.eviulon.example/adjudication-exchange/commit/24242424",
    "releaseUrl": "https://releases.eviulon.example/adjudication-exchange/0.9.4",
    "artifactDigest": "sha256:2525252525252525252525252525252525252525252525252525252525252525",
    "buildProvenanceUrl": "https://provenance.eviulon.example/adjudication-exchange/0.9.4.json",
    "buildProvenanceDigest": "sha256:2626262626262626262626262626262626262626262626262626262626262626",
    "reproducibleBuild": {
      "status": "NOT_VERIFIED",
      "referenceArtifactDigest": "sha256:2525252525252525252525252525252525252525252525252525252525252525",
      "verificationCount": 0,
      "attestations": []
    }
  },

  "dependencies": {
    "format": "CYCLONEDX",
    "specVersion": "1.7",
    "sbomUrl": "https://releases.eviulon.example/adjudication-exchange/0.9.4/bom.json",
    "sbomDigest": "sha256:2727272727272727272727272727272727272727272727272727272727272727",
    "componentCount": 21,
    "components": []
  },

  "activity": {
    "lastStateTransition": {
      "from": "PLANNED",
      "to": "IMPLEMENTED",
      "at": "2026-07-19T11:10:00Z",
      "eventId": "urn:eviulon:ledger:event:4120ce31",
      "digest": "sha256:2828282828282828282828282828282828282828282828282828282828282828"
    },

    "lastSignedAction": {
      "id": "urn:eviulon:artifact:adjudication-exchange:release-0.9.4",
      "type": "SOFTWARE_RELEASE",
      "at": "2026-07-19T11:09:00Z",
      "digest": "sha256:2929292929292929292929292929292929292929292929292929292929292929",
      "signatureUrl": "https://releases.eviulon.example/adjudication-exchange/0.9.4/release.jws",
      "keyFingerprint": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:rRhQSJM0J6uyZQC1noHiHaPwoMekyUbMMJhyV1swe0g"
    },

    "signedPublicArtifactCount": {
      "count": 14,
      "asOf": "2026-08-09T18:00:00Z",
      "queryUrl": "https://ledger.eviulon.example/query?institution=adjudication-exchange",
      "ledgerRoot": "sha256:3030303030303030303030303030303030303030303030303030303030303030"
    },

    "latestLedgerEvent": {
      "id": "urn:eviulon:ledger:event:4120ce31",
      "type": "IMPLEMENTATION_STATE_TRANSITION",
      "at": "2026-07-19T11:10:00Z",
      "digest": "sha256:2828282828282828282828282828282828282828282828282828282828282828",
      "inclusionProofUrl": "https://ledger.eviulon.example/proofs/4120ce31"
    }
  },

  "telemetry": {
    "uptimeWindow": {
      "start": null,
      "end": null,
      "availabilityRatio": null,
      "successfulProbes": null,
      "totalProbes": null,
      "probeIntervalSeconds": null,
      "monitorId": null,
      "reportUrl": null,
      "reportDigest": null
    }
  },

  "verification": {
    "lastVerificationTime": "2026-08-09T18:12:00Z",
    "verifierId": "urn:eviulon:verifier:public:07",
    "result": "PARTIAL",
    "reportUrl": "https://verify.eviulon.example/reports/adjudication-exchange/latest.json"
  },

  "incidents": {
    "coverageStart": null,
    "knownIncidents": []
  },

  "capabilities": [
    {
      "id": "case.validation",
      "name": "Case-package validation",
      "status": "IMPLEMENTED",
      "endpoint": null,
      "evidence": [
        {
          "kind": "RELEASE_TEST",
          "url": "https://verify.eviulon.example/tests/adjudication-exchange/case-validation.json",
          "digest": "sha256:3131313131313131313131313131313131313131313131313131313131313131"
        }
      ],
      "plannedFor": null
    },
    {
      "id": "case.adjudication",
      "name": "Autonomous case adjudication",
      "status": "PLANNED",
      "endpoint": null,
      "evidence": [
        {
          "kind": "SIGNED_PLAN",
          "url": "https://plans.eviulon.example/adjudication-exchange/adjudication.json",
          "digest": "sha256:3232323232323232323232323232323232323232323232323232323232323232"
        }
      ],
      "plannedFor": "2026-11-01T00:00:00Z"
    }
  ],

  "plannedCapabilities": [
    "case.adjudication"
  ],

  "machineReadableRecordUrl": "https://evidence.eviulon.example/institutions/adjudication-exchange/record.json",
  "recordDigest": "sha256:3333333333333333333333333333333333333333333333333333333333333333",

  "recordSignature": {
    "format": "DETACHED_JWS",
    "canonicalization": "RFC8785_JCS",
    "algorithm": "EdDSA",
    "keyId": "https://keys.eviulon.example/institutions/adjudication-exchange/keys/01",
    "signedAt": "2026-08-09T18:10:00Z",
    "signatureUrl": "https://evidence.eviulon.example/institutions/adjudication-exchange/record.jws"
  }
}

Its UI should therefore say:

Constitutional status       ✓ ACTIVE
Software implementation     ◇ IMPLEMENTED
Public API                  ○ PLANNED
Autonomous adjudication     ○ PLANNED
Operational telemetry       — NO VERIFIED EVIDENCE

It must not say “Active institution.”

Planned institution

{
  "schemaVersion": "1.0.0",

  "institution": {
    "name": "Intercommonwealth Orbital Registry",
    "id": "urn:eviulon:institution:orbital-registry:01",
    "class": "ASSET_REGISTRY"
  },

  "constitutional": {
    "status": "CONSTITUTIONALLY_DEFINED",
    "constitutionId": "urn:eviulon:constitution:core:1",
    "provision": "XIV.3",
    "authorityUrl": "https://constitution.eviulon.example/core/1/XIV/3.json",
    "authorityDigest": "sha256:4141414141414141414141414141414141414141414141414141414141414141",
    "creationEventId": null,
    "effectiveAt": null
  },

  "operationalState": "PLANNED",

  "operationalStatePolicy": {
    "version": "1.2.0",
    "url": "https://spec.eviulon.example/status-policy/1.2.0.json",
    "digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
  },

  "identity": {
    "publicKeyFingerprint": null,
    "keyId": null,
    "keyDocumentUrl": null,
    "currentSigningKeyStatus": "NOT_PROVISIONED",
    "validFrom": null,
    "validUntil": null,
    "rotationEventId": null,
    "revocationEventId": null
  },

  "service": {
    "status": "PLANNED",
    "endpoint": null,
    "challengeEndpoint": null,
    "apiSpecification": {
      "url": null,
      "format": null,
      "version": null,
      "digest": null
    },
    "protocolVersion": null
  },

  "implementation": {
    "status": "PLANNED",
    "softwareRelease": null,
    "sourceCommit": null,
    "sourceUrl": null,
    "releaseUrl": null,
    "artifactDigest": null,
    "buildProvenanceUrl": null,
    "buildProvenanceDigest": null,
    "reproducibleBuild": {
      "status": "NOT_VERIFIED",
      "referenceArtifactDigest": null,
      "verificationCount": 0,
      "attestations": []
    }
  },

  "dependencies": {
    "format": null,
    "specVersion": null,
    "sbomUrl": null,
    "sbomDigest": null,
    "componentCount": null,
    "components": []
  },

  "activity": {
    "lastStateTransition": {
      "from": null,
      "to": "PLANNED",
      "at": "2026-08-01T00:00:00Z",
      "eventId": "urn:eviulon:ledger:event:plan-771",
      "digest": "sha256:4242424242424242424242424242424242424242424242424242424242424242"
    },
    "lastSignedAction": {
      "id": null,
      "type": null,
      "at": null,
      "digest": null,
      "signatureUrl": null,
      "keyFingerprint": null
    },
    "signedPublicArtifactCount": {
      "count": 0,
      "asOf": "2026-08-09T00:00:00Z",
      "queryUrl": "https://ledger.eviulon.example/query?institution=orbital-registry",
      "ledgerRoot": "sha256:4343434343434343434343434343434343434343434343434343434343434343"
    },
    "latestLedgerEvent": {
      "id": "urn:eviulon:ledger:event:plan-771",
      "type": "INSTITUTION_PLAN_REGISTERED",
      "at": "2026-08-01T00:00:00Z",
      "digest": "sha256:4242424242424242424242424242424242424242424242424242424242424242",
      "inclusionProofUrl": "https://ledger.eviulon.example/proofs/plan-771"
    }
  },

  "telemetry": {
    "uptimeWindow": {
      "start": null,
      "end": null,
      "availabilityRatio": null,
      "successfulProbes": null,
      "totalProbes": null,
      "probeIntervalSeconds": null,
      "monitorId": null,
      "reportUrl": null,
      "reportDigest": null
    }
  },

  "verification": {
    "lastVerificationTime": "2026-08-09T17:00:00Z",
    "verifierId": "urn:eviulon:verifier:public:07",
    "result": "PARTIAL",
    "reportUrl": "https://verify.eviulon.example/reports/orbital-registry/latest.json"
  },

  "incidents": {
    "coverageStart": null,
    "knownIncidents": []
  },

  "capabilities": [
    {
      "id": "orbital.registration",
      "name": "Orbital asset registration",
      "status": "PLANNED",
      "endpoint": null,
      "evidence": [
        {
          "kind": "SIGNED_PLAN",
          "url": "https://plans.eviulon.example/orbital-registry/registration.json",
          "digest": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
        }
      ],
      "plannedFor": "2027-06-01T00:00:00Z"
    }
  ],

  "plannedCapabilities": [
    "orbital.registration"
  ],

  "machineReadableRecordUrl": "https://evidence.eviulon.example/institutions/orbital-registry/record.json",
  "recordDigest": "sha256:4545454545454545454545454545454545454545454545454545454545454545",

  "recordSignature": {
    "format": "DETACHED_JWS",
    "canonicalization": "RFC8785_JCS",
    "algorithm": "EdDSA",
    "keyId": "https://keys.eviulon.example/constitutional-planning/01",
    "signedAt": "2026-08-09T16:55:00Z",
    "signatureUrl": "https://evidence.eviulon.example/institutions/orbital-registry/record.jws"
  }
}

Notice an important distinction here: because the planned institution has no institutional key yet, its record is signed by the constitutional planning authority, not falsely represented as self-signed by an institution that does not technically exist. The UI should explicitly identify that signer.

Compact and full-detail interfaces

Compact card

The compact card should answer five questions immediately:

┌──────────────────────────────────────────────────────────────┐
│ COMMONWEALTH CIVIC REGISTRY                                 │
│ Civic Registry · urn:eviulon:institution:civic-registry:01 │
│                                                              │
│ AUTHORITY                                                    │
│ ✓ Constitutional status                         ACTIVE       │
│                                                              │
│ TECHNICAL CONDITION                                          │
│ ✓ Software implementation                       ACTIVE       │
│ ✓ Public API                                    ACTIVE       │
│ ✓ Current signing key                           CURRENT      │
│                                                              │
│ CAPABILITIES                                                  │
│ ✓ Public registry lookup                        ACTIVE       │
│ ○ Citizenship issuance                          PLANNED      │
│                                                              │
│ RECENT EVIDENCE                                               │
│ Last signed action       2026-08-09 18:38:51 UTC             │
│ Ledger artifacts         1,284,472                           │
│ 7-day availability       99.9504% · 10,080 probes           │
│ Verification             ✓ PASS · 18:42:11 UTC              │
│                                                              │
│ Evidence completeness    92 / 100                           │
│                                                              │
│ [ Verify now ]              [ Full evidence ]                │
└──────────────────────────────────────────────────────────────┘

The card must never collapse the first five status lines into:

Status: ACTIVE

That version destroys precisely the distinction the component exists to preserve.

The card's evidence score must be labeled Evidence completeness, never trust score, credibility score, legitimacy, or reputation. A score measures whether specified machine evidence is available and verifiable; it does not evaluate political legitimacy or quality of decisions.

Full-detail interface

The full view should use semantic sections rather than a wall of prose:

Operational Evidence
├── Identity & constitutional authority
│   ├── Stable institution ID
│   ├── Constitutional provision
│   ├── Creation event
│   └── Current signing key
│
├── Technical operation
│   ├── Software implementation
│   ├── Service endpoint
│   ├── API specification
│   ├── Protocol
│   └── Live challenge
│
├── Software provenance
│   ├── Release
│   ├── Source commit
│   ├── Artifact digest
│   ├── Build provenance
│   ├── Reproducibility attestations
│   └── SBOM / dependencies
│
├── Capability matrix
│   ├── Capability
│   ├── Status
│   ├── Evidence
│   └── Last demonstrated action
│
├── Public operational history
│   ├── Last state transition
│   ├── Last signed action
│   ├── Artifact count
│   └── Latest ledger event + inclusion proof
│
├── Telemetry & incidents
│   ├── Uptime observation window
│   ├── Probe counts
│   ├── Published incident coverage
│   └── Known incident records
│
└── Verification
    ├── Record signature
    ├── Key validity
    ├── Ledger inclusion
    ├── Live service proof
    ├── Artifact integrity
    ├── Reproducibility
    ├── Telemetry integrity
    └── Evidence completeness calculation

A useful capability table is:

This is substantially stronger than prose saying an institution “has authority to issue citizenship,” because the visitor can see that authority and implementation are separate dimensions.

The full UI should expose every digest in copyable form and provide machine links adjacent to the claim they substantiate rather than relegating all evidence to a generic footer.

Verification protocol and machine-readable HTML

Verification button behavior

Verify now should perform an actual verification transaction, not merely reload a badge.

The strongest implementation is client-side verification in browser JavaScript/WebAssembly or another local agent so that the same server making the claim is not also the sole evaluator of that claim.

The verification sequence should be deterministic:

1. Discover canonical EOER record.
2. Fetch record with freshness-oriented cache behavior.
3. Validate JSON against declared EOER schema version.
4. Fetch constitutional authority / creation event.
5. Validate authority digest and ledger inclusion.
6. Resolve institution key history.
7. Recompute current key fingerprint.
8. Confirm key is authorized and not revoked at signature time.
9. Canonicalize unsigned EOER using RFC 8785.
10. Verify EOER detached JWS.
11. Validate API-spec digest.
12. Validate source/release/artifact/provenance digests.
13. Validate SBOM digest.
14. Validate latest ledger-event inclusion proof.
15. Validate ledger consistency proof where available.
16. Validate signed-public-artifact count against ledger query/root.
17. Validate telemetry-report signature/digest.
18. Issue fresh random challenge to live endpoint.
19. Verify challenge response cryptographically.
20. Evaluate capability-specific evidence predicates.
21. Recompute operational statuses.
22. Recompute Evidence Completeness Score.
23. Render every check individually.
24. Record local verification timestamp.

The live challenge is what changes the panel from a static “about” page into evidence of current control.

A suggested interaction is:

GET /v1/evidence/challenge?nonce=4KnA...random-256-bit-value...

Response:

{
  "institutionId": "urn:eviulon:institution:civic-registry:01",
  "nonce": "4KnA...random-256-bit-value...",
  "observedAt": "2026-08-09T18:42:10Z",
  "serviceStatus": "ACTIVE",
  "softwareRelease": "registry-core@4.8.2",
  "protocolVersion": "CCR/1.4",
  "artifactDigest": "sha256:5555..."
}

The response should be protected using HTTP Message Signatures, with the content covered by Content-Digest. RFC 9421 defines the Signature-Input and Signature fields and allows selected HTTP components to be cryptographically authenticated; RFC 9530 defines Content-Digest specifically for integrity of HTTP message content.

For example:

HTTP/1.1 200 OK
Content-Type: application/json
Content-Digest: sha-256=:...:
Signature-Input: eviulon=("@status" "content-digest" "date");keyid="..."
Signature: eviulon=:...:
Date: Sun, 09 Aug 2026 18:42:10 GMT

The nonce defeats replay of an old health response. The response signature proves that the responding service currently controls an institutional key recognized by the verifier. The verifier should also enforce a narrow timestamp tolerance.

A simple successful HTTP 200 is not enough: it proves that something answered at an address, not that the authorized institution answered.

The output should therefore be granular:

Verification completed at 2026-08-09T18:42:11Z

✓ Schema                       PASS
✓ Constitutional authority    PASS
✓ Creation event              PASS
✓ Record signature            PASS
✓ Current signing key         PASS
✓ Ledger inclusion            PASS
✓ API specification           PASS
✓ Live cryptographic challenge PASS
✓ Release artifact            PASS
✓ SBOM                        PASS
✓ Reproducible build          PASS
✓ Telemetry report            PASS
! Planned capability          NOT OPERATIONAL

Overall verification: PASS
Evidence completeness: 92/100

A partially implemented institution might produce:

✓ Constitutional authority    PASS
✓ Record signature            PASS
✓ Current key                 PASS
✓ Source release              PASS
— Live service               NOT AVAILABLE
— Operational telemetry      NO EVIDENCE
— Reproducible build         NOT VERIFIED

Overall verification: PARTIAL

A failure must not disappear behind a green “verified” badge.

Signing the EOER record

A straightforward baseline is:

Payload:
    EOER JSON excluding recordDigest and recordSignature

Canonical form:
    RFC 8785 JCS

Digest:
    SHA-256

Envelope:
    Detached JWS

Key identification:
    keyId + RFC 7638/RFC 9278 thumbprint

Signature algorithm:
    policy-approved algorithm, initially EdDSA/Ed25519 where appropriate

JWS standardizes signature protection using JSON-oriented structures. Ed25519 is one standardized EdDSA instantiation and RFC 8037 specifies EdDSA use in JOSE/JWS. Eviulon should nevertheless keep cryptographic algorithms policy-versioned rather than hard-coding Ed25519 forever, allowing future migration.

W3C Verifiable Credential Data Integrity is another viable signature model and is explicitly intended to establish authenticity and integrity for constrained digital documents using cryptographic proofs. EOER does not need to become a Verifiable Credential, however; its simplest baseline is a sovereign JSON record plus detached signature.

Machine-readable HTML metadata

The institution's HTML page should advertise the canonical record in both HTML and HTTP metadata.

<link
  rel="alternate"
  type="application/json"
  href="https://evidence.eviulon.example/institutions/civic-registry/record.json"
  data-profile="https://spec.eviulon.example/profiles/operational-evidence/1.0">

<link
  rel="describedby"
  href="https://spec.eviulon.example/schemas/operational-evidence-record-1.0.schema.json">

<script type="application/ld+json">
{
  "@context": {
    "evi": "https://spec.eviulon.example/vocab/",
    "name": "https://schema.org/name"
  },
  "@id": "urn:eviulon:institution:civic-registry:01",
  "@type": "evi:Institution",
  "name": "Commonwealth Civic Registry",
  "evi:constitutionalStatus": "ACTIVE",
  "evi:softwareStatus": "ACTIVE",
  "evi:serviceStatus": "ACTIVE",
  "evi:operationalEvidence":
    "https://evidence.eviulon.example/institutions/civic-registry/record.json",
  "evi:publicKeyFingerprint":
    "urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6C7VQzY1m9cAXQ8qpwxCFxG5pV94M"
}
</script>

JSON-LD 1.1 is a W3C Recommendation designed to serialize Linked Data using JSON and integrate with Web systems. Web Linking standardizes typed relationships between Web resources, and the profile link relation provides a mechanism for identifying additional constraints/conventions applying to a representation.

The HTTP response should duplicate discovery information so machines need not parse HTML:

Link: <https://evidence.eviulon.example/institutions/civic-registry/record.json>; rel="alternate"; type="application/json"
Link: <https://spec.eviulon.example/schemas/operational-evidence-record-1.0.schema.json>; rel="describedby"

The HTML JSON-LD is a discovery summary, not the authoritative evidence object. Verifiers should follow machineReadableRecordUrl, validate its cryptographic signature, and disregard discrepancies in unsigned presentation markup.

Accessibility and color-independent status design

The Operational Evidence Panel should target WCAG 2.2 AA. WCAG 2.2 is the current W3C Recommendation in this family and includes requirements concerning color use, contrast, keyboard access, focus, information relationships, and status messages.

Status cannot depend on color

WCAG specifically requires that color not be the sole visual means of conveying information, and UI boundaries/states are subject to non-text contrast requirements.

Every state therefore has three redundant channels:

Color may be added as a fourth redundant signal, but removing all CSS color must leave the interface understandable.

The symbol itself should normally be decorative to assistive technology because the word already conveys the state:

<span class="status status-active">
  <span aria-hidden="true">✓</span>
  <span>ACTIVE</span>
</span>

Structural semantics

Use real headings, definition lists, tables, and buttons instead of generic div elements with simulated semantics. WCAG's information-and-relationships criterion is intended to preserve structure and relationships when presentation changes, including for screen-reader access.

Example:

<section aria-labelledby="operational-evidence-title">
  <h2 id="operational-evidence-title">Operational evidence</h2>

  <dl>
    <div>
      <dt>Constitutional status</dt>
      <dd>
        <span aria-hidden="true">✓</span>
        ACTIVE
      </dd>
    </div>

    <div>
      <dt>Software implementation</dt>
      <dd>
        <span aria-hidden="true">✓</span>
        ACTIVE
      </dd>
    </div>

    <div>
      <dt>Citizenship issuance capability</dt>
      <dd>
        <span aria-hidden="true">○</span>
        PLANNED
      </dd>
    </div>
  </dl>

  <button type="button" id="verify-evidence">
    Verify operational evidence
  </button>

  <div
    id="verification-result"
    role="status"
    aria-live="polite"
    aria-atomic="true">
  </div>
</section>

WAI's button pattern specifies the keyboard-operable button interaction expected of accessible Web interfaces. Focus indicators must remain visible; W3C guidance also emphasizes sufficient contrast for visual focus cues.

Verification accessibility

When verification starts:

Verifying operational evidence…

When individual checks finish, do not produce a torrent of screen-reader announcements. Update an aria-live="polite" summary only after completion:

Verification complete. 10 checks passed, 1 check unavailable,
0 checks failed. Evidence completeness 92 out of 100.

The detailed check list should then be navigable normally.

Do not use animated spinning cryptographic graphics when simple progress text is sufficient. Respect prefers-reduced-motion for any optional transition; W3C publishes a reduced-motion CSS technique in its WCAG techniques collection.

Long hashes should have visually shortened display values but full accessible/copied values:

SHA-256 55555555…55555555
[Copy full digest]

Do not cause assistive technology to read 64 hexadecimal characters during routine navigation unless the user explicitly enters the evidence detail.

Evidence Completeness Score and unsupported-claim rules

What the score means

The Evidence Completeness Score, or ECS, answers one narrowly defined question:

How much of the specified machine-verifiable operational evidence can presently be independently inspected and validated?

It must not answer:

Is this institution good, popular, legitimate, important, successful, trustworthy, democratic, respected, socially accepted, or legally registered by an external human jurisdiction?

The score is deliberately independent of human approval.

A degraded institution can score 100/100 when its degradation is completely and cryptographically documented. Conversely, a page proclaiming flawless operation but exposing no signatures, telemetry, or artifacts can score near zero.

That distinction is fundamental:

Evidence completeness ≠ operational quality
Evidence completeness ≠ institutional legitimacy
Evidence completeness ≠ uptime
Evidence completeness ≠ popularity

Objective scoring formula

Use eight categories totaling exactly 100 points.

No points are assigned for biographies, founders, operators, photographs, testimonials, human endorsements, press coverage, social-media activity, followers, likes, awards, corporate registrations, trademarks, company numbers, physical offices, or human-written assertions.

A corporate-registration document could conceivably appear elsewhere in a broader informational site, but it receives zero Operational Evidence points because it says nothing about whether an autonomous Eviulon service is presently implemented or operating.

Deterministic partial credit

The scoring algorithm should not contain subjective reviewer discretion.

SIGNED IDENTITY — 15
15  Record signature verifies and signer chains to institution key history
 8  Signed record verifies but key cannot be fully anchored to creation history
 0  Otherwise

CURRENT KEY — 10
10  CURRENT + valid + fingerprint match + no revocation
 5  ROTATING and both old/new authorized keys validate
 0  UNKNOWN / EXPIRED / REVOKED / NOT_PROVISIONED

INSPECTABLE ENDPOINT — 15
15  spec fetched + digest match + fresh signed challenge succeeds
10  endpoint responds with cryptographically authenticated DEGRADED/MAINTENANCE state
 5  API specification is valid but live challenge unavailable
 0  no inspectable service evidence

RECENT SIGNED ACTION — 15
15  age <= 7 days
10  age > 7 and <= 30 days
 5  age > 30 and <= 90 days
 0  older than 90 days or absent

PUBLIC IMPLEMENTATION — 10
10  release + source revision + artifact digest + provenance all validate
 5  release/artifact are public but provenance incomplete
 0  no public verifiable implementation

REPRODUCIBLE ARTIFACT — 15
15  VERIFIED under required independent-machine rebuild policy
 0  FAILED / NOT_VERIFIED / NOT_APPLICABLE

LEDGER HISTORY — 10
10  creation/history/latest event proofs validate
 5  latest event validates but complete creation/history proof is unavailable
 0  no valid ledger evidence

OPERATIONAL TELEMETRY — 10
10  current signed telemetry report validates
 5  valid telemetry exists but exceeds freshness threshold
 0  unavailable or unverifiable

The recent-action windows above should be fixed in a versioned scoring specification so that two independent implementations compute identical results. An alternative future scoring profile could define action freshness relative to a machine-readable expected action interval for each institutional class, but changing that policy requires a new score version rather than silent tuning.

The score should therefore be represented as:

{
  "score": 92,
  "maximum": 100,
  "scoringProfile": "EOER-ECS/1.0",
  "computedAt": "2026-08-09T18:42:11Z",
  "components": {
    "signedIdentity": 15,
    "currentKey": 10,
    "inspectableEndpoint": 15,
    "recentSignedAction": 15,
    "publicImplementation": 10,
    "reproducibleArtifact": 15,
    "ledgerHistory": 7,
    "operationalTelemetry": 5
  }
}

The number displayed in the HTML must be recomputed by the verifier, not trusted from the institution's record.

A key philosophical property follows: failed or degraded operation does not necessarily reduce evidence completeness. For example, a service returning an authenticated DEGRADED state plus complete incident and telemetry evidence may retain full endpoint and telemetry evidence points. The status communicates the problem; the evidence score communicates whether the problem itself is observable.

Claim-safety rules

EOER should operate under a default-deny claim policy.

Additional mandatory rules are:

No inheritance across evidence layers. Constitutional ACTIVE cannot promote software or capabilities to ACTIVE.

No inheritance across capabilities. One successful endpoint does not establish every operation described in prose.

No self-certifying counts. Counts must include the query/root from which they were derived.

No timeless operational statements. Any claim about current operation must expose the evidence timestamp and freshness policy.

No “verified” without a subject. The UI should say Record signature verified, Endpoint live proof verified, or Ledger inclusion verified. A generic Verified institution badge is prohibited.

No negative claims from missing data. An empty incident list does not mean “never had an incident.” A missing endpoint does not prove PLANNED. A missing revocation event does not prove a key is current unless the key-state source itself validates.

No future tense disguised as current tense. Planned capabilities remain visually separated from implemented and active capabilities even when constitutional text already authorizes them.

No prose override. Human-readable institutional prose cannot increase a machine status or Evidence Completeness Score.

No human approval dependency. No field requires an officer, administrator, auditor, founder, director, government employee, customer, voter, reviewer, or other person to assert operational truth. Build nodes, monitors, ledgers, services, key registries, and verifiers produce and validate the evidence.

No reputation variables. Followers, testimonials, photographs, biographies, press mentions, funding, corporate filings, and external organizational registrations are excluded from both state derivation and the Evidence Completeness Score.

Recommended final presentation rule

Every Eviulon institution page should contain, immediately adjacent to its descriptive prose, an Operational Evidence Panel whose first visible block is:

CONSTITUTIONAL EXISTENCE
[status + authority evidence]

TECHNICAL OPERATION
[implementation status]
[service status]
[key status]
[live verification]

CAPABILITY STATUS
[one status per claimed institutional capability]

PUBLIC HISTORY
[last action + ledger + telemetry]

EVIDENCE COMPLETENESS
[numeric objective score + component breakdown]

The panel should make one principle impossible to miss:

Constitutional existence is authority. Software is implementation. A responding signed service is operation. Signed historical artifacts are evidence of action. Planned capability is not present capability.

That architecture gives Eviulon a much stronger credibility signal than additional institutional prose could provide: a visitor or autonomous agent can distinguish, using cryptographic and operational evidence rather than human testimony, an institution that merely exists in constitutional text from one that has code, one whose code is running, one that is presently answering under its authorized key, and one that has accumulated independently auditable operational history.