Evidence contract

Unknown is a first-class result.

Evidence records the invoking runtime, bounded policy decisions, observations, limitations, and redaction metadata. A missing observation is never promoted to a green check.

What is not retained

NetOkay does not retain credentials, cookies, request bodies, full user-agent values, proxy URLs or credentials, certificate chains, target URLs after policy evaluation, or response bodies.

Agent runtime boundary

agent_internal_runtime remains not_observed. A caller-declared host marker is not attestation. Evidence is local unless a human explicitly shares it.