Repository navigation
REQ 092
For every lane run that reaches the guest, whatever its outcome, the engine shall write one machine-readable evidence record (schema projectbuddy/lane-evidence@1) that binds the schema version, the engine commit, the candidate commit, the canonical declaration's SHA-256, the lane identity (host OS, guest OS and build, hypervisor and version, base image identity), the declared and observed tool versions, the SHA-256 and size of each declared output, the forwarded secret names (REQ-093), each phase's argument vectors, observed network link state, and received secret names (REQ-106), and the run status (passed, failed with exit code, timeout, or probe-mismatch).
A consumer's own gate can verify lane evidence mechanically only if the record binds the candidate and the environment (challenge ledger row CH-06 in VITechnologies/projectbuddy#159). Lane-independent fields (candidate commit, declaration digest, tool versions, output digests) are directly comparable across lanes; lane identity fields are expected to differ. The base image identity comes from VITechnologies/projectbuddy#166. The record is unsigned: its unkeyed digests detect accidental change and mismatched inputs, but per REQ-076 they do not authenticate evidence against a process with the same host identity. Protected evidence integrity (REQ-076) and attestation semantics (open decision D-4 in VITechnologies/projectbuddy#159) stay outside this requirement.
(1) A verifier recomputes the declaration digest and every output digest and size from the retained declaration and outputs, and they match the record. (2) The record contains no forbidden key name, at least activation_code, credential, email, full_name, fullname, installation_id, password, private_key, serial, serial_number, and token. (3) The evidence directory contains exactly the record and the declared outputs, and no declared output name matches a VM disk, saved-state, VM settings, or known-hosts pattern (*.vdi, *.vmdk, *.vhd, *.vhdx, *.sav, *.vbox, known_hosts); this allow-list, not a key scan, is what excludes those artifacts. (4) No forwarded secret value occurs in any evidence byte (REQ-093). Changing any bound field fails verification, and a declaration naming such an output is rejected before any VM mutation.
Planned, TEST-094; no lane executor exists yet.
Software-Requirements-Specification
High
Planned lane workload contract cases
Planned lane executor; not implemented
Planned