Definition
A proof artifact is any record that provides the basis for a claim about a software release and can be examined independently of the person or tool that produced it. Examples include scanner retest reports, test results on a specific artifact, reviewer attestations with commit references, runtime telemetry, decision records, and policy-version snapshots.
A proof artifact is not evidence merely because it exists. It must be relevant to the claim, bound to the correct artifact and policy version, and preserved in a form that can be reviewed later. A closed ticket without a linked artifact is not a proof artifact.
Why it matters
Claims without artifacts are assertions. In an audit, incident review, or customer conversation, the ability to point to a preserved proof artifact is what separates a defensible decision from an opinion. Proof artifacts are the raw material of release-evidence verification.
Example
A proof artifact for a vulnerability fix might include: the original scanner finding, the commit that changed the code, a retest report showing the behavior is absent in the release candidate, and a reviewer attestation naming the commits reviewed. Each item is tied to the release candidate by a content address or version identifier.
Related terms
- Release-evidence verification — The practice of determining whether the evidence behind a software release decision satisfies versioned policy.
- Vulnerability fix proof — Independent evidence that a reported vulnerability no longer applies to the release candidate.
- Policy-version binding — Associating a release decision with the exact version of policy that was active when the decision was made.
- Defensible release decision — A release decision whose basis can be reviewed and explained long after the decision was made.