Evidence levels, receipts, and gate verdicts.
Every run is graded to an explicit evidence level, sealed in a signed receipt, and judged by a gate whose verdict lists exact blocking reasons — never inferred from a green process exit.
Evidence levels#
Probierz grades each run on an ordered E-scale. The run-level computation is deterministic:
- E0 — the run did not pass. A failed run never contributes evidence.
- E2 — a passed run with its report and analysis, without forced capture.
- E3 — a passed run executed with recording on, whose report, analysis, and captured media are all present.
- E4 — a full condition-matrix run in which every cell passed and met the required cell-level evidence.
- Gate policies set a minimum level per mode; the default minimum is E3.
Signed evidence receipts#
A receipt binds runs to their exact identities: run ID, target, journey identities, status, evidence level, harness source, application source (git SHA plus worktree hash per repository), build hash, timestamps, artifact hashes, and media. Receipts are signed with Ed25519 and verified with `probierz verify-receipt` against a trusted public key.
Around receipts sit retention policies, encrypted-at-rest protected bundles, pre-upload secret scanning, and audit history. An unavailable evidence store is an error, not an empty history.
Gate verdicts#
A gate evaluates in `pull-request` or `release` mode against the application manifest's policy for that mode. The verdict is explicit: passed, plus the complete list of blocking errors. Probierz never infers approval from screenshots, prose, figure verdicts, or an unverified process exit.
Blocking reasons include: a run that did not pass; missing or mismatched harness and application source identity; a missing exact build hash; an evidence level below the policy minimum; missing or hash-mismatched artifacts; a run kind that does not match the gate mode; runs that do not identify one exact application source; and, when the policy requires them, a missing encrypted artifact bundle or a missing passing secret scan.
Evaluate-only inspection is separate from activating or enforcing a repository gate. A gate that has not yet been activated green denies with "gate is pending green activation", and activation itself is refused while the gate is not green.
Status projection#
`probierz status` composes the manifest, run history, affected-mappings, and git into one view: whether each required journey has evidence at all, how fresh that evidence is against the current HEAD, its evidence level, which journeys the current diff affects, and whether the pull-request policy would let HEAD merge right now — with the exact reasons when it would not.
Status reads the selected application's manifest, not every other registered application. Required journeys remain part of the decision even when the comparison contains no changed files; missing required evidence cannot become a green result merely because HEAD already matches the comparison ref.