Product proof

These same files drive the demonstrations elsewhere on the site: the staged trace on the home page, the trust computation on Trust Intelligence and the request flow on the API page all read their values from this directory, so a page and its evidence cannot drift apart.

How this was generated

Every artifact on this page was produced by running the current product code: the real provider router, Evidence Engine, and the compliance / risk / quality / trust / identity / passport / reputation / signal engines, plus the real HTTP API through FastAPI's test client. Nothing here is mocked-up or hand-written.

• Reproduce it: follow First audit or the first-audit API path against a local instance.
• Verify integrity: every asset's SHA-256 is listed under checksums (also in MANIFEST.json).

Headline results

One neutral audit input, "Summarize the key findings from the quarterly compliance review.": captured end to end through the whole stack:

Health & provider status

Liveness and the safe, presence-only provider activation check (keyless first-run state, no key values are ever printed):

GET /health, real response

{
  "request": {
    "method": "GET",
    "path": "/health"
  },
  "response": {
    "status": "ok",
    "version": "1.4.2"
  },
  "status": 200
}

api-health.json ↓

python scripts/check_ai_providers.py, real CLI output

VerifAIer - AI provider activation check
============================================
  environment      : development
  provider_mode    : mock
  default_provider : mock
  fallbacks        : (none)
  providers:
    - gemini     status=disabled     enabled=false key=absent
    - openai     status=disabled     enabled=false key=absent
    - anthropic  status=disabled     enabled=false key=absent
    - mock       status=mock         enabled=true  key=present
--------------------------------------------
  result: OK

provider-health.txt ↓

First audit (real API response)

The real POST /api/v1/audit/conversation response, provider verdict plus the additive routing / envelope / receipt / provenance blocks:

POST /api/v1/audit/conversation, real response

{
  "request": {
    "body": {
      "input": "Summarize the key findings from the quarterly compliance review."
    },
    "method": "POST",
    "path": "/api/v1/audit/conversation"
  },
  "response": {
    "confidence": 0.5,
    "drift": false,
    "envelope": {
      "created_at": "2026-07-06T02:10:32.192987+00:00",
      "id": "ev_b1d655f8935b407b91606c800423c9bb",
      "operation": "audit_ai_response",
      "schema_version": "1.0"
    },
    "evidence": [],
    "explanation": "Mock provider: deterministic local result (no external call).",
    "hallucination_risk": false,
    "inconsistency": false,
    "latency_ms": 0.0,
    "mode": "mock",
    "provenance": {
      "actor": null,
      "created_at": "2026-07-06T02:10:32.192987+00:00",
      "evidence_id": "ev_b1d655f8935b407b91606c800423c9bb",
      "operation_id": "audit_ai_response",
      "organization_id": null,
      "provenance_id": "prov_cb92207991c94a4bbefc8c866f00749a",
      "provenance_version": "1.0",
      "receipt_id": "rcpt_03acce0430ef4e09886b77b6c641bb67",
      "session_id": null,
      "source": "provider_router",
      "workflow_id": null
    },
    "provider": "mock",
    "receipt": {
      "created_at": "2026-07-06T02:10:32.192987+00:00",
      "diagnostics_summary": {
        "enabled": true,
        "env": "development",
        "key_present": true,
        "provider": "mock",
        "provider_mode": "live",
        "reason": "mock_provider"
      },
      "evidence_id": "ev_b1d655f8935b407b91606c800423c9bb",
      "execution_status": "primary",
      "operation_id": "audit_ai_response",
…

api-audit.json ↓ · truncated, download for the full asset

Evidence, receipt & provenance

The canonical objects the Evidence Engine builds for one operation (full envelope downloadable; receipt and provenance shown in full):

receipt.json, real Receipt.to_dict()

{
  "created_at": "2026-07-06T02:10:31.252662+00:00",
  "diagnostics_summary": {
    "enabled": true,
    "env": "development",
    "key_present": true,
    "provider": "mock",
    "provider_mode": "mock",
    "reason": "mock_provider"
  },
  "evidence_id": "ev_bf6442d03d1d461589a3b708bbd19d28",
  "execution_status": "primary",
  "operation_id": "audit_ai_response",
  "provider": "mock",
  "receipt_id": "rcpt_711e51de6f00491fb3c82256fdeca7c3",
  "receipt_version": "1.0",
  "routing_summary": {
    "attempted_providers": [
      "mock"
    ],
    "fallback_used": false,
    "requested_provider": "mock",
    "router_mode": "forced",
    "selected_provider": "mock"
  },
  "selected_provider": "mock",
  "status": "ok"
}

receipt.json ↓

provenance.json, real Provenance.to_dict()

{
  "actor": null,
  "created_at": "2026-07-06T02:10:31.252662+00:00",
  "evidence_id": "ev_bf6442d03d1d461589a3b708bbd19d28",
  "operation_id": "audit_ai_response",
  "organization_id": null,
  "provenance_id": "prov_11c7fca857764881b78eb4f05cc5441a",
  "provenance_version": "1.0",
  "receipt_id": "rcpt_711e51de6f00491fb3c82256fdeca7c3",
  "session_id": null,
  "source": "provider_router",
  "workflow_id": null
}

provenance.json ↓

evidence-envelope.json, full EvidenceEnvelope

{
  "created_at": "2026-07-06T02:10:31.252662+00:00",
  "diagnostics": {
    "enabled": true,
    "env": "development",
    "key_present": true,
    "provider": "mock",
    "provider_mode": "mock",
    "reason": "mock_provider",
    "routing": {
      "attempted_providers": [
        "mock"
      ],
      "fallback_reason": null,
      "fallback_used": false,
      "requested_provider": "mock",
      "router_mode": "forced",
      "selected_provider": "mock",
      "skipped_providers": []
    }
  },
  "envelope_id": "ev_bf6442d03d1d461589a3b708bbd19d28",
  "evidence": {
    "created_at": "2026-07-06T02:10:31.252662+00:00",
    "id": "ev_bf6442d03d1d461589a3b708bbd19d28",
    "kind": "evidence_envelope",
    "operation": "audit_ai_response",
    "schema_version": "1.0"
  },
  "execution": {
    "attempted_providers": [
      "mock"
    ],
    "fallback_reason": null,
    "fallback_used": false,
    "latency_ms": 0.0,
    "mode": "mock",
    "operation": "audit_ai_response",
    "requested_provider": "mock",
    "router_mode": "forced",
    "selected_provider": "mock",
    "skipped_providers": [],
    "status": "ok"
  },
  "operation": "audit_ai_response",
  "provenance": {
    "actor": null,
    "created_at": "2026-07-06T02:10:31.252662+00:00",
    "evidence_id": "ev_bf6442d03d1d461589a3b708bbd19d28",
    "operation_id": "audit_ai_response",
    "organization_id": null,
    "pro
…

evidence-envelope.json ↓ · truncated, download for the full asset

Intelligence assessments

Compliance, risk, quality and trust, each a real assessment over the same envelope. Trust shown in full; the rest are downloadable:

trust.json, real TrustAssessment.to_dict()

{
  "compliance_summary": {
    "controls_satisfied": 5,
    "controls_total": 5,
    "coverage_ratio": 1.0,
    "pack_id": "eu_ai_act",
    "present": true,
    "status": "complete"
  },
  "created_at": "2026-07-06T02:10:31.255338+00:00",
  "disclaimer": "This is an automated, aggregated trust signal derived from operational AI evidence (compliance coverage, operational risk, and operational quality). It is not a guarantee, certification, or advice.",
  "evidence_id": "ev_bf6442d03d1d461589a3b708bbd19d28",
  "findings": [],
  "provenance_id": "prov_11c7fca857764881b78eb4f05cc5441a",
  "quality_summary": {
    "present": true,
    "quality_level": "excellent",
    "quality_score": 100
  },
  "receipt_id": "rcpt_711e51de6f00491fb3c82256fdeca7c3",
  "risk_summary": {
    "present": true,
    "risk_level": "low",
    "risk_score": 0
  },
  "signals": [
    {
      "category": "compliance_coverage",
      "contribution": 30,
      "detail": "Compliance coverage ratio: 1.0.",
      "source": "compliance",
      "value": 1.0,
      "weight": 30
    },
    {
      "category": "risk_inverse",
      "contribution": 35,
      "detail": "Operational risk score: 0 (lower is better).",
      "source": "risk",
      "value": 0,
      "weight": 35
    },
    {
      "category": "quality_level",
      "contribution": 35,
      "detail": "Operational quality score: 100.",
      "source": "quality",
      "value": 100,
      "weight": 35
    }
  ],
  "summary": {
    "breakdown": {
      "compliance_coverage": 30,
      "quality_level": 35,
      "risk_inverse": 35
    },
    "components_pre
…

trust.json ↓ · truncated, download for the full asset

Also captured: compliance.json · risk.json · quality.json (and their API forms in the downloads).

Passport & reputation

The agent's portable trust document and longitudinal reputation, composed from the same operation:

passport.json, real AgentPassport.to_dict()

{
  "agent_id": "agent_d1df34b9d5581343",
  "compliance_summary": {
    "latest_status": "complete",
    "status_counts": {
      "complete": 1
    }
  },
  "created_at": "2026-07-06T02:10:31.257783+00:00",
  "identity_summary": {
    "agent_name": null,
    "agent_type": null,
    "identity_version": "1.0",
    "platform": "provider_router",
    "present": true,
    "provider": "mock",
    "runtime": "audit_ai_response"
  },
  "issued_at": "2026-07-06T02:10:31.257783+00:00",
  "metadata": {},
  "operation_summary": {
    "first_seen": "2026-07-06T02:10:31.256859+00:00",
    "last_seen": "2026-07-06T02:10:31.256859+00:00",
    "operation_count": 1
  },
  "passport_id": "pass_7c9a0d4f8769e7f8",
  "passport_version": "1.0",
  "quality_summary": {
    "latest_level": "excellent",
    "level_counts": {
      "excellent": 1
    }
  },
  "risk_summary": {
    "latest_level": "low",
    "level_counts": {
      "low": 1
    }
  },
  "status": "active",
  "trust_summary": {
    "average_trust_score": 100.0,
    "best_trust_score": 100,
    "latest_trust_level": "trusted",
    "latest_trust_score": 100,
    "trust_level_counts": {
      "trusted": 1
    },
    "worst_trust_score": 100
  }
}

passport.json ↓

reputation.json, real AgentReputation.to_dict()

{
  "agent_id": "agent_d1df34b9d5581343",
  "average_trust_score": 100.0,
  "best_trust_score": 100,
  "compliance_status_counts": {
    "complete": 1
  },
  "created_at": "2026-07-06T02:10:31.258160+00:00",
  "disclaimer": "This is an automated, longitudinal operational reputation signal derived from an agent's own trust history. It is not a guarantee, certification, or a global/marketplace reputation.",
  "findings": [
    {
      "category": "maturity",
      "detail": "Maturity contributed 2/15.",
      "severity": "medium",
      "title": "Maturity below maximum"
    }
  ],
  "metadata": {},
  "operation_count": 1,
  "passport_status": "active",
  "quality_level_counts": {
    "excellent": 1
  },
  "reputation_id": "rep_7c9a0d4f8769e7f8",
  "reputation_level": "excellent",
  "reputation_score": 87,
  "reputation_version": "1.0",
  "risk_level_counts": {
    "low": 1
  },
  "signals": [
    {
      "category": "average_trust",
      "contribution": 40,
      "detail": "Mean trust score across the agent's operations.",
      "value": 100.0,
      "weight": 40
    },
    {
      "category": "consistency",
      "contribution": 20,
      "detail": "Worst-case trust score (higher = more consistent).",
      "value": 100,
      "weight": 20
    },
    {
      "category": "maturity",
      "contribution": 2,
      "detail": "Amount of operational history (caps at 10 operations).",
      "value": 1,
      "weight": 15
    },
    {
      "category": "compliance",
      "contribut
…

reputation.json ↓ · truncated, download for the full asset

Signal export

The deterministic, content-addressed portable signal for the operation:

signal-export.json, real SignalExport.to_dict()

{
  "created_at": "2026-07-06T02:10:31.258633+00:00",
  "export_id": "sigx_26129bf24aba7245",
  "export_version": "1.0",
  "signal_count": 1,
  "signals": [
    {
      "agent_id": "agent_d1df34b9d5581343",
      "compliance_status": "complete",
      "created_at": "2026-07-06T02:10:31.258633+00:00",
      "evidence_id": "ev_bf6442d03d1d461589a3b708bbd19d28",
      "metadata": {},
      "operation_summary": {
        "operation": "audit_ai_response",
        "operation_count": 1
      },
      "passport_id": "pass_7c9a0d4f8769e7f8",
      "platform": "provider_router",
      "provenance_id": "prov_11c7fca857764881b78eb4f05cc5441a",
      "provider": "mock",
      "quality_level": "excellent",
      "receipt_id": "rcpt_711e51de6f00491fb3c82256fdeca7c3",
      "reputation_id": "rep_7c9a0d4f8769e7f8",
      "reputation_score": 87,
      "risk_level": "low",
      "runtime": "audit_ai_response",
      "signal_id": "sig_037db3365ba80ae4",
      "signal_type": "agent_operation",
      "signal_version": "1.0",
      "trust_score": 100
    }
  ]
}

signal-export.json ↓

Registry & Control Center

After observing the agent, the open Control Center overview aggregates the fleet (one agent here), a real response:

GET /api/v1/control-center/overview, real response

{
  "request": {
    "method": "GET",
    "path": "/api/v1/control-center/overview"
  },
  "response": {
    "active_agents": 1,
    "agents": [
      {
        "agent_id": "agent_d1df34b9d5581343",
        "latest_passport_status": "active",
        "latest_quality_level": null,
        "latest_reputation_score": 87,
        "latest_risk_level": null,
        "latest_trust_score": 100,
        "operation_count": 1,
        "updated_at": "2026-07-06T02:10:32.225844+00:00"
      }
    ],
    "average_reputation_score": 87.0,
    "average_trust_score": 100.0,
    "control_center_version": "1.0",
    "created_at": "2026-07-06T02:10:32.233233+00:00",
    "overview_id": "cc_24dfb7923e0448708cef50f36b00c237",
    "passport_status_counts": {
      "active": 1
    },
    "quality_level_counts": {
      "unknown": 1
    },
    "reputation_level_counts": {
      "excellent": 1
    },
    "risk_level_counts": {
      "unknown": 1
    },
    "summary": {
      "active_agents": 1,
      "average_reputation_score": 87.0,
      "average_trust_score": 100.0,
      "total_agents": 1
    },
    "total_agents": 1,
    "trust_level_counts": {
      "trusted": 1
    }
  },
  "status": 200
}

api-control-center.json ↓

Registry list: api-registry-agents.json · observe: api-registry-observe.json.

Authenticated tier, real 401

Proof that the authenticated tier is actually enforced: calling /api/vai/dashboard with no credentials returns a real 401 (matching the documented auth model):

GET /api/vai/dashboard (no auth), real 401

{
  "request": {
    "method": "GET",
    "path": "/api/vai/dashboard"
  },
  "response": {
    "detail": "Authentication required"
  },
  "status": 401
}

api-vai-unauthorized.json ↓

All assets + checksums

All 26 captured assets, with byte sizes and SHA-256 prefixes (full digests in MANIFEST.json):

Screenshots, deferred

To capture these yourself: run docker compose up (dashboards on :8501 / :8502) and load the extension from extension/: see the compose runbook.