Proof sample

Sample decision artifact

A decision artifact records the explicit outcome of evaluating qualified release evidence against versioned customer policy. It preserves the evidence snapshot, policy digest, and replay command needed to reproduce the decision.

This is a synthetic example for illustration.

What this artifact proves

That the release evidence was qualified and evaluated under a specific, versioned policy.
That the outcome—Proceed, Stop, Escalate, or Require—is explicit and bound to the evidence snapshot.
That the basis for the decision can be replayed and audited later using the preserved policy digest and replay command.
That the artifact has not been altered in transit, via a DSSE envelope and decision fingerprint.

What this artifact does not prove

That the software is free of all defects or unknown vulnerabilities.
That no security event will occur after the decision is acted upon.
That the policy itself is complete or correct for every jurisdiction.
That downstream enforcement of the outcome is guaranteed.

Artifact fields

Field	Role
decision_fingerprint	Uniquely identifies the decision and detects change.
evidence_snapshot	The qualified evidence that was evaluated.
policy_version	The active customer policy at decision time.
policy_digest	A cryptographic digest of the policy version.
freshness_state	Whether the evidence was within the policy freshness window.
trust_state	The qualification result, such as qualified_and_corroborated.
dsse_envelope	Signing status and envelope protecting the artifact.
downgrade_reason_codes	Records any explicit acceptance or downgrade.
replay_command	Deterministic command to reproduce the evaluation.
runtime_corroboration	Independent runtime evidence confirming or qualifying the claim.

Screenshot-style preview of a sample decision artifact

Synthetic decision artifact (JSON)

{
  "artifact_type": "release_decision",
  "decision_fingerprint": "sha256:7f8a9b...e3d2c1",
  "evidence_snapshot": {
    "bom_reference": "gosentrix:bom:payment-service:2.4.1@build-8842",
    "scanner_results": [
      {
        "tool": "primary_sast",
        "high_findings": 0,
        "critical_findings": 0,
        "freshness_hours": 4
      },
      {
        "tool": "container_scan",
        "critical_findings": 0,
        "freshness_hours": 18
      }
    ],
    "ai_provenance": {
      "ai_generated_lines": 12,
      "reviewer_attestation": "approved"
    },
    "runtime_corroboration": {
      "source": "runtime_telemetry",
      "status": "no_exposure_observed"
    }
  },
  "policy_version": "v1.3.2",
  "policy_digest": "sha256:a1b2c3...f4e5d6",
  "freshness_state": "fresh",
  "trust_state": "qualified_and_corroborated",
  "dsse_envelope": {
    "payload_type": "application/vnd.gosentrix.decision+json",
    "signatures": [
      {
        "keyid": "prod-signer-2026",
        "sig": "..."
      }
    ]
  },
  "outcome": "Proceed",
  "downgrade_reason_codes": [],
  "replay_command": "gosentrix replay --decision-fingerprint sha256:7f8a9b...e3d2c1 --evidence-snapshot gosentrix:bom:payment-service:2.4.1@build-8842 --policy-version v1.3.2"
}

Download JSON sample Download YAML sample

How this maps to the GoSentrix doctrine

Evidence before authorization

The artifact does not exist until evidence has been qualified and evaluated.

Versioned policy binding

policy_version and policy_digest bind the outcome to the exact policy in force.

Explicit outcomes

The outcome field is one of a fixed set; there is no silent pass-through.

Replayability

The replay_command lets an auditor reproduce the evaluation basis later.

Frequently asked questions

What is a decision artifact?

A decision artifact is a preserved record of the evidence, policy, and reasoning that led to a specific release decision. It links the evidence snapshot, policy version, and outcome so the decision can be replayed or audited later.

Why does the artifact include a policy digest and a decision fingerprint?

The policy digest binds the decision to the exact policy version that was active at evaluation time. The decision fingerprint uniquely identifies the combination of evidence, policy, and outcome, making it possible to detect tampering or drift.

Is a decision artifact the same as a CI pass?

No. A CI pass is a build and test result. A decision artifact records whether the qualified evidence satisfies customer policy and what explicit outcome followed.

Can the decision be replayed?

Yes. The artifact includes a replay command that re-runs the evaluation against the preserved evidence snapshot and policy version, producing the same basis for the decision.

Preserve the basis for every decision.

GoSentrix qualifies evidence, evaluates it against versioned policy, and produces decision artifacts that can be replayed and audited.

Explore release-evidence verification Read the doctrine