VSO updates SDK evidence checks, the Explorer demo and Evidect reproduction guidance
VSO has added the latest GitHub updates to its public information: stricter SDK replay inputs, an API-connected Explorer route using signed synthetic evidence, and a reproducible Evidect exercise. These are separate tools and verification records, with different limits.
First-party checks; experimental extensions remain unadopted
Experimental extensions and proposed repairs remain unadopted. Independent third-party reproduction has not been established. A merged change, successful CI job or public demo is not formal adoption, full VCP/VAP conformance, production suitability, certification or an external anchor.
1. SDK: reject invalid inputs and preserve uncertainty
SDK PR #7 rejects non-object JSON, duplicate keys, invalid UTF-8 and malformed or duplicate proofs instead of silently using a bundled fixture or treating them as valid evidence. A missing proof produces INDETERMINATE; a demonstrated mismatch produces INVALID. Expected outcomes, exact fixture bytes and agreement with API claims are checked separately. The SDK CI, API parity check and public API probe succeeded on the merged commit c2bc767. These are first-party checks.
The public probe exercised Python urllib, curl and Node fetch on Ubuntu 24.04 and macOS 14, including local SDK replay of downloaded evidence. The two environments are not independent evaluators. Earlier HTTP 403 observations remain historical records; their exact cause is not established. Windows, arbitrary user networks and continued hosting availability are not guaranteed.
2. Explorer: a new signed-evidence route, alongside the legacy dashboard
The SDK Evidence Demo obtains verification reports from the public API and offers synthetic event JSONL and AnchorRecord downloads. Its browser interface displays the API report; it does not independently repeat the cryptographic verification. The deployed API uses the pinned SDK revision 70240a4, not the newer SDK c2bc767 discussed above.
| Synthetic case | Local checks | Full evidence |
|---|---|---|
| intact | VALID | INDETERMINATE |
| tampered | INVALID | INVALID |
| missing-key | INDETERMINATE | INDETERMINATE |
Even the intact case remains INDETERMINATE for full evidence: local cryptographic checks do not establish external anchoring, real-world identity, trustworthy time or completeness beyond the checked scope. The separate legacy dashboard still uses 12 unsigned, unanchored synthetic leaves and is API-disconnected. The dated 159 API / 26 GUI test notice describes that earlier checkpoint; it is preserved and is not added to SDK test counts.
3. Evidect: a fixed reproduction entry point and live-page checks
The Evidect reproduction guide provides a one-command exercise covering 22 synthetic stages, pinned to implementation b394db7 and guide 1c0d567. It records evidence observations and report handoff; it does not operate production controls, connect to AILEX/AWS or prove regulatory compliance. Reports are unsigned, editable observations rather than certificates.
Evidect PR #19 added first-party checks of the deployed page in Chromium at widths 320, 390, 768 and 1280, with JavaScript enabled and disabled. All eight conditions passed in the post-deployment run 40887632944 on 29 October, including source-byte comparisons, keyboard navigation and visible anchor headings. This is one-environment browser QA, not physical-device, Safari/Firefox, WCAG certification or independent reproduction coverage.
Dated records and existing boundaries are preserved
The 28 October SDK record (306 Python / 140 TypeScript tests per job), the 27 October Explorer record (159 API / 26 GUI tests), VAP-LAP proposal links and fixed research distributions remain available. This website update changes explanatory material only: current normative requirements, existing implementations, signed data, fixed distributions and K3 are unchanged.
Open the Evidence DemoOpen the reproduction guide