# PlatPhorm Evidence — Full Manifest

Deterministic claim verification ledger for security investigations. Every claim is checked against resolved evidence, coverage gaps are surfaced explicitly, and every verdict is receipted by content digest.

Engine: evidence-verifier-v2

## What this service is
Evidence is a verification ledger. It takes claims (assertions about an
incident) and evidence references (pointers to observations, relationships,
activity chains, entities, artifacts, and external knowledge) and produces a
deterministic verdict. It is deliberately conservative: absence of supporting
evidence yields UNSUPPORTED or UNVERIFIABLE, and contradicting evidence always
dominates.

## What this service is NOT
- It does not collect telemetry (that is Correlate).
- It does not decide investigative next steps (that is Investigate).
- It does not use a language model to reach verdicts. Verdicts are rule-based
  and reproducible.

## Verification rules (evaluated in fixed order)
- reference-integrity: every evidence reference must resolve to a real object
- primary-evidence-boundary: derived relationships alone cannot fully verify an incident claim without an observation or artifact
- external-knowledge-boundary: ATT&CK and other external knowledge remain context and cannot prove incident behavior
- entity-grounding: named hosts, users, IPs, files, buckets, byte counts, timestamps, and predicates must appear in cited evidence
- source-coverage: claims requiring an absent telemetry class are constrained and emit a coverage gap
- supporting-evidence-present: at least one resolved supporting reference is required to support a claim
- no-unresolved-support: unresolved references cannot count toward support
- contradiction-scan: any resolved contradicting reference forces CONTRADICTED
- classification-consistency: the claim's classification must be consistent with its evidence (e.g. OBSERVED needs an observation)
- temporal-consistency: evidence timestamps must be internally consistent where present

## Verdict precedence
CONTRADICTED > UNSUPPORTED > UNVERIFIABLE > PARTIALLY_SUPPORTED > SUPPORTED

## Classifications
OBSERVED (directly seen in a source), INFERRED (derived from relationships),
HYPOTHESIS (proposed, not yet supported), UNKNOWN.

## Reference types
observation, relationship, activity_chain, entity, artifact,
external_knowledge, trace, claim.

## Coverage model
Every source type carries a coverage state: PRESENT, PARTIAL, ABSENT, UNKNOWN,
DEGRADED. Gaps carry a severity: informational, material, critical. A claim
that depends on an absent required source is not allowed to pass and the
missing telemetry class is emitted as a first-class coverage gap.

## Receipts and provenance
Every write emits a provenance record (who/what created it, source service,
trace id) and every verification/import emits a receipt anchored by a SHA-256
digest over canonical JSON. Digests are stable across runs.

## Contracts (canonical Zod -> JSON Schema)
- evidence.case.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.case.v1
- evidence.source-coverage.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.source-coverage.v1
- evidence.coverage-gap.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.coverage-gap.v1
- evidence.claim.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.claim.v1
- evidence.claim-version.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.claim-version.v1
- evidence.reference.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.reference.v1
- evidence.artifact-reference.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.artifact-reference.v1
- evidence.verification-result.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.verification-result.v1
- evidence.evidence-bundle.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.evidence-bundle.v1
- evidence.receipt.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.receipt.v1
- evidence.provenance.v1  ->  https://evidence.platphormnews.com/api/v1/openapi.json#/components/schemas/evidence.provenance.v1

## Endpoints
See https://evidence.platphormnews.com/llms.txt for the endpoint list and https://evidence.platphormnews.com/api/v1/openapi.json for
the full OpenAPI 3.1 document.

## Authentication
Reads are open. Writes (claim create, verify, import) require the PlatPhorm
service key sent as 'Authorization: Bearer <key>' or
'X-PlatPhorm-API-Key: <key>'.
Idempotency-Key is honored on claim creation and Correlate import.

## Network position
Root graph: https://platphormnews.com
Upstream source material: correlate.platphormnews.com