EVE Proof & verification

AI Decision Audit Trail

Every governed decision EVE makes can produce a record you can hand to a reviewer: what was decided (ALLOW / BLOCK / MODIFY), the reason codes, the decision identifier, and a signature that proves the record was not altered. Because the decision path is deterministic, the record is reproducible.

What the audit trail contains

The decision — action, reason codes, and a decision identifier bound to the policy version.
A signature — ECDSA P-384 (AWS KMS) in production configuration (HMAC-SHA256 fallback), over a versioned canonicalization (jcs-1).
A verifiable envelope — content hash plus signature, verifiable independently and offline.
Determinism marker — evidence records llm_in_decision_path == false, confirming the verdict was rule-computed.

Verify a record

from eve_coreguard import verify_decision_record

report = verify_decision_record(evidence_envelope, public_key_pem=pubkey)
# report.valid == True; report.algorithm == "ecdsa-p384"; report.independently_verifiable == True

import { verifyDecisionRecord } from "eve-ai-governance";
const report = await verifyDecisionRecord(envelope, { publicKeyPem: pubkey });
// report.valid === true (offline; public keys only, no network)

Readiness

Signed decision evidence is SUPPORTED; offline verification in Python, Node, and the browser is SUPPORTED; jcs-1 canonicalization with cross-language byte parity is SUPPORTED. The surrounding governance decision is PILOT_READY.

Limitations

Verification proves the evidence is authentic and unaltered; it does not attest that the underlying decision was correct.
Independent (asymmetric) verification requires the ECDSA P-384 public key. The HMAC-SHA256 fallback is symmetric and is not independently verifiable.
jcs-1 is a constrained canonicalization profile; it does not serialize non-integer floats / NaN / Infinity (it fails closed). Signed governance artifacts stay within the supported value domain (for example, rates carried as integer permille).

Next step

Take a signed decision record from a pilot run and verify it yourself, offline, with the public key.