EvidenceBound — Trust-Aware Runtime Assurance & Verifiable Recovery

Core model

Separate historical integrity from current trust.

A checkpoint can remain intact and still be unsafe to reuse because evidence changed, provenance disappeared, policy drifted or a dependency became untrustworthy.

Bind

Evidence, provenance and versioned policy become protected state.

Verify

Deterministic checks return ALLOW, REVIEW_REQUIRED or BLOCK.

Invalidate

Changed, stale, missing or refuted evidence remains explicit.

Contain

Dependency analysis isolates exact affected descendants.

Recover

Unaffected work is reused only when verification permits it.

Reference implementations

Inspect systems, not slogans.

Prior hackathon and research systems are preserved as maintainer-owned reference implementations. They demonstrate integration patterns; they are not presented as independent external adoption.

Google Cloud · multi-agent recovery

Recovery Mesh

Controlled trust failure → dependency blast radius → selective recovery. The documented controlled comparison used 4 model calls / 1,781 input tokens for full restart versus 3 / 1,358 for selective recovery, avoiding one call and 423 tokens in that exact run.

FrameworkGoogle ADK

RuntimeCloud Run

PlannerDeterministic

StatusResearch prototype

Source ↗Devpost ↗

DataHub MCP · governed data actions

DataHub Gate

Real DataHub metadata is bound into an Evidence Pack, evaluated by deterministic policy and restricted execution, then retained as a SHA-256 Proof Pack with an Ed25519 reference signing path.

InputDataHub MCP

ExecutionRestricted AST

ReceiptProof Pack

ModeFail closed

Source ↗Devpost ↗

CockroachDB × AWS · decision state

Verified Memory

Canonical T0 decision-state snapshots are persisted, reconstructed and rehashed before trust, then compared with T1 to explain evidence and verdict changes rather than merely recalling an answer.

StoreCockroachDB

RuntimeAWS Lambda

IntegritySHA-256

StatusHackathon prototype

Source ↗Devpost ↗

Pre-core archive

Earlier EvidenceBound-MAS surfaces, migrated from SignalReview.

These pages established the narrow-claim philosophy that later became part of the standalone OSS project.

Proof Explorer

Contestable verification

Constrained specification, fail-closed AST policy, deterministic execution, semantic counterexamples and content-addressed proof scope. Human review remained mandatory.

Agent Safety Testbed

Proposal ≠ execution authority

The model could propose or revise a candidate, while deterministic policy and runtime boundaries—not model confidence—controlled eligibility for review.

Audit Compliance Surface

Governed evidence chain

Versioned operator contract, exact candidate identity, bounded runtime evidence, content-addressed integrity and explicit human approval before promotion.

Legacy/pre-core surfaces are preserved as design lineage. They are not current normative EvidenceBound Core specifications, customer adoption, or legal/compliance certification.

Research lineage

From contestable proof to trust-aware recovery.

EvidenceBound evolved from deterministic verification experiments inside SignalReview into a standalone framework-neutral OSS runtime centered on protected state, applicability, dependency invalidation and selective recovery.

Migrated field note

Deterministic Control Plane for Autonomous Agents

Why prompt rules, self-critique and confidence scores cannot substitute for an enforceable execution boundary tied to an exact proposal.

Migrated field note

Reproducible Evidence for Governed AI Execution

Auditability as a binding problem: exact contract, candidate, runtime result, integrity evidence and accountable approval context.

SignalReview reference case

Verify the Algorithm, Not the Outcome

Separating algorithm-conformance evidence from claims about sporting, medical, commercial or future outcomes.

Historical document · 2026

EvidenceBound-MAS: Verifiable Evidence for Human Decision-Making

The original whitepaper predates the standalone EvidenceBound Core and is preserved as design lineage, not the current normative specification.

Historical PDF ↗Current OSS source ↗

Security model

Explicit trust boundaries.

EvidenceBound makes narrow, reproducible claims. Integrity and signatures can bind/authenticate bytes under configured trust roots; they cannot make a malicious upstream source truthful.

Built to enforce

Evidence, provenance and policy binding.
Deterministic integrity/applicability checks.
Exact dependency blast-radius computation.
Fail-closed gates for consequential actions.
Selective recovery with path-specific re-verification.

Not claimed

Not a truth oracle for malicious upstream sources.
Not universal runtime-compromise detection.
No guarantee of secure key custody or immutable storage.
No automatic AI Act or legal compliance guarantee.
No substitution for adversarial-ML/red-team systems.

Ruslan Vrublevskyi

Maintainer · EvidenceBound Core · Kyiv, Ukraine

AI systems and trust-infrastructure builder focused on deterministic verification, evidence-bound state, selective recovery, interoperability and externally verifiable engineering evidence.

ruslan@evidencebound.org GitHub LinkedIn ORCID

Research & consortium

Independent OSS identity

EvidenceBound is presented as an independent open-source project; SignalReview remains a separate sports-intelligence product and application domain. EvidenceBound is not represented as an incorporated company.

Runtime assurance for agentic/autonomous AI.
Post-detection containment and recovery.
Cross-runtime conformance and benchmarks.
Independent validation and security review.

Discuss collaboration