This document specifies the machine-readable contracts of the Evidence Ledger: the event envelope, the payload fields per event type, and the artifact, park, and checkpoint records. The envelope is strict — field set and order are fixed. The event-type vocabulary is closed and matches the taxonomy table exactly.
Event envelope
| Field | Type | Semantics |
|---|---|---|
event_id |
string | Event identity |
workflow_id |
string | Run identity — the join key for a full trail |
step_id |
string | Step identity, where the event is step-scoped |
event_type |
enum | One of the closed vocabulary |
timestamp |
string | ISO-8601 UTC, at the moment of the event |
data |
object | Typed payload per event type |
checksum |
string | Chain link over this event's content and the preceding link |
{
"event_id": "evt_…",
"workflow_id": "wf_…",
"step_id": "DD10",
"event_type": "verification",
"timestamp": "2026-10-24T09:41:07Z",
"data": {
"verdict": "pass",
"criteria": ["…"],
"critique": null
},
"checksum": "sha256:…"
}Excerpt — event envelope shape. Field structure is contractual; values are per-run.
Payload fields by event type
| Event type | Payload fields |
|---|---|
step_start |
action_type, context digest |
step_complete |
artifact reference |
policy_eval |
policy_id, decision — ALLOW or DENY — tool, parameter digest |
tool_call |
tool, redacted parameters, outcome |
hitl_escalation |
tier — n of N — diagnosis, consumed-inputs digest |
hitl_park |
diagnosis, failure signature, unresolved escalation count |
verification |
verdict, criteria references, critique |
compensation |
step_id, compensation action, outcome, order index |
regeneration |
parent step, generation — _rN — child workflow identity |
circuit_breaker |
failure signature, consecutive generations, halt reason |
workflow_complete |
terminal state, terminal artifact references |
Artifact record
| Field | Type | Semantics |
|---|---|---|
artifact_id |
string | art_… — content-checksum-derived identity |
content_checksum |
string | Integrity anchor; the address and the integrity check are the same property |
step_id |
string | Producing step |
sealed_at |
string | ISO-8601 UTC, at commit |
schema_ref |
string | The declared output schema the artifact validated against |
Artifacts are immutable. Referencing steps resolve by identifier during hydration; nothing copies, and nothing mutates a sealed artifact.
Park record
| Field | Type | Semantics |
|---|---|---|
workflow_id |
string | Parked run |
step_id |
string | Step holding the gate |
diagnosis |
object | Failure signature and consumed-inputs digest — what the operator resolves against |
escalations_issued |
number | Tier count consumed before the park |
resolution |
object | Resolution class — data provision, instruction, gap acceptance, reject — with the response reference and consumed flag |
The resolution slot is written once, on consumption. A park with no resolution consumes no compute.
Checkpoint record
| Field | Type | Semantics |
|---|---|---|
workflow_id |
string | Run identity |
completed_prefix |
array | Ordered step identities committed at the safe boundary |
artifact_refs |
array | Sealed artifacts the prefix references |
budget_consumption |
object | Snapshot of every level in the budget hierarchy |
created_at |
string | ISO-8601 UTC |
Resume-from seeds a restart from this record; budget consumption carries, because budgets bind the workflow, not the incarnation.
Chain verification
Any third party can re-walk the trail: start at the first event, recompute each checksum over its content and the preceding link, and compare. A mismatch localizes tampering to the exact event. The verification procedure requires nothing beyond the trail itself — no side channel, no trusted clock beyond the chain order.
Redaction rule
Events record that a call was made, with evaluated parameters; they never record credential material. Parameters appear as digests where they contain secret-bearing fields. An auditor can verify every decision the plane made without handling a single secret — the redaction is structural, not a post-processing step.