Proof sample

Sample replay command

A replay command is a deterministic invocation that re-evaluates a preserved evidence snapshot and policy version, reproducing the basis for a release decision without depending on live tool state.

This is a synthetic example for illustration.

What this artifact proves

That the exact evidence snapshot and policy version used for a decision can be identified.
That the decision basis can be reconstructed independently of the original CI pipeline or environment.
That the replay command itself is signed and bound to the decision fingerprint.
That auditors can verify what was evaluated, not just what outcome was recorded.

What this artifact does not prove

That running the command against new evidence will produce the same outcome.
That every environmental dependency outside the snapshot is identical.
That the replay itself constitutes a new authorization to release.
That the original evidence snapshot captured all relevant facts.

Artifact fields

Field	Role
replay_command	The deterministic invocation that reproduces the evaluation.
decision_fingerprint	Identifies the decision whose basis is being replayed.
evidence_snapshot	The preserved evidence used as input to the replay.
policy_version	The policy version evaluated during replay.
policy_digest	Digest of the policy version, guarding against silent substitution.
freshness_state	The freshness state recorded for the original evidence.
trust_state	The qualification state recorded for the original evidence.
dsse_envelope	Signing status protecting the replay command and its inputs.
downgrade_reason_codes	Any explicit acceptances that influenced the original outcome.

Screenshot-style preview of a sample replay command artifact

Synthetic replay command artifact (JSON)

{
  "artifact_type": "replay_command",
  "replay_command": "gosentrix replay --decision-fingerprint sha256:7f8a9b...e3d2c1 --evidence-snapshot gosentrix:bom:payment-service:2.4.1@build-8842 --policy-version v1.3.2 --verify-signature",
  "decision_fingerprint": "sha256:7f8a9b...e3d2c1",
  "evidence_snapshot": {
    "bom_reference": "gosentrix:bom:payment-service:2.4.1@build-8842",
    "scanner_results": [
      {
        "tool": "primary_sast",
        "high_findings": 0,
        "critical_findings": 0,
        "freshness_hours": 4
      },
      {
        "tool": "container_scan",
        "critical_findings": 0,
        "freshness_hours": 18
      }
    ],
    "runtime_corroboration": {
      "source": "runtime_telemetry",
      "status": "no_exposure_observed"
    }
  },
  "policy_version": "v1.3.2",
  "policy_digest": "sha256:a1b2c3...f4e5d6",
  "freshness_state": "fresh",
  "trust_state": "qualified_and_corroborated",
  "dsse_envelope": {
    "payload_type": "application/vnd.gosentrix.replay+json",
    "signatures": [
      {
        "keyid": "replay-signer-2026",
        "sig": "..."
      }
    ]
  },
  "downgrade_reason_codes": [],
  "expected_outcome": "Proceed"
}

Download JSON sample Download YAML sample

How this maps to the GoSentrix doctrine

Reproducibility

The replay command encodes how to reconstruct the evaluation basis, not just the result.

Evidence preservation

evidence_snapshot and policy_version are preserved so replay does not depend on live systems.

Tamper detection

decision_fingerprint and dsse_envelope reveal if the command or inputs are altered.

Auditability

Auditors can run or inspect the replay command to confirm the decision basis.

Frequently asked questions

What is a replay command?

A replay command is a deterministic invocation that re-evaluates a preserved evidence snapshot against the policy version that was active when a decision was made. It reproduces the basis for the decision without relying on live systems.

Why is replayability important for release decisions?

Replayability lets auditors, incident responders, and reviewers reconstruct why a decision was made. It separates the original basis from later changes in tools, policy, or environment.

Does replaying always produce the same outcome?

Replaying the same evidence snapshot and policy version produces the same evaluation basis. The outcome can change if the evidence snapshot or policy version is different, which is why both are preserved in the artifact.

Who can run a replay command?

Anyone with access to the evidence snapshot, policy version, and replay tooling can run it. The result is a reconstruction of the decision basis, not a new authorization.

Make every decision reproducible.

GoSentrix preserves evidence snapshots, policy versions, and replay commands so the basis for every release decision can be reconstructed.

Explore release-evidence verification Read the doctrine