Module evidence 

The evidence module: from a claim to the run that proves it, and back.

docs/CLAIMS.yaml binds a claim to a test by path. crate::evidence binds that path to the runs actually recorded against it. These capabilities are the one declaration of that join, and every surface — the command line, the HTTP API and its OpenAPI operation, the MCP tool a client reads — is derived from it. There is no second evidence model behind any of them.

Both directions

A relation that can only be walked one way is half a relation. evidence.claim answers “what proves this claim”; evidence.test answers “what does this test prove”, listing every claim that names it. They read the same derivation, so the two answers cannot disagree.

Why the recorder is here and not exposed over the network

evidence.record writes a tracked file, and this executable’s MCP and HTTP surfaces are read-only — that is a property of the server, not an accident of what has been built. So it declares a command line and nothing else, which Visibility::Developer is exactly the word for: offered to whoever runs the executable and to nobody over a network. Declaring it as a capability rather than as a hand-written command is what keeps it inside the registry, the command graph and the generated reference instead of in the inventory of commands nothing derives.

use majordomus_cli::capability::builtin::evidence;

let m = evidence::module();
assert_eq!(m.id.as_str(), "evidence");
let ids: Vec<&str> = m
    .capabilities
    .iter()
    .map(|e| e.capability.id.as_str())
    .collect();
assert_eq!(
    ids,
    [
        "evidence.report",
        "evidence.claim",
        "evidence.test",
        "evidence.record",
        "evidence.stamp"
    ]
);

// the recorder writes a tracked file, so it is offered to whoever runs the executable
// and to nobody over a network; that is what keeps the server read-only
let record = m
    .capabilities
    .iter()
    .find(|e| e.capability.id.as_str() == "evidence.record")
    .unwrap();
assert!(record.capability.exposure.mcp.is_none());
assert!(record.capability.exposure.http.is_none());
assert_eq!(
    record.capability.exposure.cli.as_ref().unwrap().path,
    ["evidence".to_string(), "record".to_string()]
);

Why the stamp is offered only to whoever runs the executable

evidence.stamp writes nothing, but it reads a file whose path its caller names (the report it digests) and measures the checkout it runs in. A network client must not choose a path this executable reads, so the stamp too declares a command line and nothing else.

Example

The capabilities, and every projection — the command line, the HTTP operation, the MCP tool — is derived from that one declaration.

use majordomus_cli::capability::builtin::evidence::module;
let m = module();
assert_eq!(m.id.as_str(), "evidence");
assert_eq!(m.capabilities.len(), 5);

Structs

ClaimEvidence

One claim with everything the repository can say about its proof, and the way back out to the test that carries it.

EvidenceClaimInput

One claim of the matrix, named by the id it is declared under.

EvidenceRecordInput

A run to record into the ledger.

EvidenceReportInput

Which part of the matrix to answer for, and at which revision.

EvidenceStampInput

What a run asks to have measured about the checkout it leaves: its producer, its report, and its own untracked outputs, which are not a change to what it tested.

EvidenceTestInput

One test, by its stable identity or by the path a claim names it with.

RecordReport

What a recording did: how much of the run reached the ledger, and under what provenance.

TestEvidence

One test, and what it proves.

Constants

EVIDENCE_URI

The URI under which the whole evidence report is read as an MCP resource.

Functions

module

The evidence module: claims joined to the runs recorded against them.