VSO publishes saved runtime report verification and an incident evidence review
These two merged Evidect updates were checked at 09:48 JST on 1 November 2026. This announcement is based on published source and CI logs; the experiments were not rerun for this publication.
Research status — unadopted; independent reproduction not established
Experimental extensions remain unadopted; independent third-party reproduction is not established. First-party CI, saved-evidence rechecks and public-page checks are distinct from independent fresh execution, adoption, full conformance, production assurance or certification.
1. Evidect #28: receiver verification of saved runtime reports
The exact original runtime-report.json bytes travel with a signed observation handoff. The receiver separately selects a trusted public key, current checkpoint and clock. It verifies the signature, expiry, context, size and SHA-256, then recomputes summaries for eight recorded cases. A valid signature does not excuse a summary that contradicts the saved observations. Contradictions remain CONTRADICTION; missing observations remain null / INDETERMINATE. The demo deletes the temporary producer private key before invoking the receiver CLI and checks changed bytes, missing trust and repeatable verification.
Change / source commit: evidect-site PR #28 · ebb8e3a9728af999d9c88387c10ac5e80b929e97 · First-party CI record
What is checked, and what is not re-established
The receiver does not rerun the original operation or observe the current environment. Original request, approval and context signatures and historical authorization remain NOT_REVERIFIED. Truthful and complete collection and actor attribution are not re-established. local_status: VALID is a narrow delivery-and-summary consistency result, not a safety verdict. The overall result is INVALID for invalid or inconsistent input, and otherwise INDETERMINATE. The same test controller creates the demo trust key and checkpoint. The demo checkpoint expires after one hour; CI artifacts are retained for 14 days.
Change / source commit: evidect-site PR #28 · 3a996242eb2352242ef0916392b3149892bf316e
2. Evidect #29: attributed incident evidence and bounded claims
A non-normative Japanese review with an English scope note separates attributed material from design inferences and distinguishes publication, detection and effective dates. It covers Chainalysis disclosures, the VOLTA sample analysis and material about US bank access restrictions. It separates VAP evidence verification from incident prevention, execution control, bank permission and legal findings. This PR changes documentation only; it does not reproduce incidents using real telemetry or malware. Its three possible future tests are unimplemented and untested, not successful test executions.
Change / source commit: evidect-site PR #29 · 2bebc7c7582fa91a08c77fd381976034f47d6aab · First-party CI record
Verified first-party CI scope
PR #28 adds 27 regression tests. At merged commit 2bebc7c after #29, logs confirm 137 tests (37 + 43 + 30 existing, plus 27 new) and eight synthetic cases on each of Ubuntu 24.04 and macOS 15, with Node.js 22 and Python 3.12. Counts are not combined across operating systems or historical suites as new tests. The existing runtime-boundary CI, Pages deployment, and public entrypoint HTTP/browser checks also passed. These are first-party checks, not independent reproduction.
Change / source commit: evidect-site PR #29 · 2bebc7c7582fa91a08c77fd381976034f47d6aab · First-party CI record
Keep historical test records intact
The 31 October post-approval, retention and interoperability record, the 30 October 53-case record, and earlier Explorer API 159 / GUI 26 results remain dated records for their own scope. The present 137 tests cover a different scope. This site update adds explanatory content and links only; current normative requirements, schemas, existing implementations, signed data, fixed distributions and K3 are unchanged.