Business sequence
From a function call to a report someone might treat as evidence.
Twelve steps. Capture is local. Custody is a later transfer, if it happens. Verification is one step, not the product. Standing is unpaid until step 11.
On the operator’s machine
Nothing has left the shop. The chain exists as a local file. Custody has not happened.
0
Naming
Entry zero is ASSIGNMENT_ANCHOR. It names the assignment before any run exists. Every later entry links back to this.
This is not completeness. An undecorated call never enters the chain.
1
Commit and seal
Arguments bind. The function runs, so the output already exists. Only then does the decorator hash those arguments and append EVIDENCE_COMMITMENT, dated to when the call started, written after it returned. RUN_SEAL follows in the same step. Chain order is commitment then seal. That is what Precedence checks. Wall-clock order is: the function ran first.
Not “fixed on the chain before the function runs.” Better than reconstructing a workfile after a letter arrives. Not historical execution.
2
Local manifest
manifest.json lands in a directory the operator passes in. No bytes have been sent anywhere.
The chain does not sit with Semafide. That was the thesis stated as the mechanism.
3
Certification
close_assignment is a separate, explicit act. It is refused if it lands in the in_flight gap between an open commitment and its seal. Coverage reads ABSENT until this happens, unconditionally.
Closing the assignment does not prove every relevant run was captured.
Afterward
Most of the timeline is silence. That is the point.
4
Dormancy
Nobody is watching. If the run depended on a recipe rather than a witness signature, this is where that recipe can go stale.
Staleness is invisible until someone tries to re-run it.
5
Trigger
A letter arrives. It asks one of two different questions: were all relevant executions disclosed, or which configuration produced this number.
The system can only ever answer the first, and only for runs that reached this chain. Configuration is the commercial investigation. It is not what the verifier reconstructs.
6
Handover
If it happens: the manifest moves to a custodian. This is the first moment custody exists. Cosigning a log head could happen here, on request.
No witness daemon runs today. Nothing in the repository calls cosign automatically.
Examination
Code also ran in steps 1, 3, and 6. This is the step where the propositions are computed.
7
Examiner inputs
The examiner supplies what verify() actually takes: trusted keys, trusted witness keys, a per-chain checkpoint, an assignment checkpoint, time anchors or a beacon resolver, retention determinations, and a rederive callback if they want Reproduction attempted.
Omit the checkpoint and Completeness reads UNCHECKED, not passed. Omit keys and nothing is trustworthy.
8
Verification
Five booleans about this run, computed independently. Separately, determinations about the record: completeness, coverage, disclosure, anchoring, holding. Time bounds is not a sixth proposition. kc2_fires asks whether this is more than a timestamped folder. EvidentiaryReliance is narrower: trustworthy, and witness or reproduction, and KC2 does not fire.
Clearing KC2 is not a decision to rely. Omit trusted keys and nothing is trustworthy.
9
Report
Lists what is established and what was never checked. It can answer completeness against a supplied checkpoint, for whatever reached this chain. If a recipe was pinned and the partner no longer serves that version, the finding is rederivation_unavailable.
CONSISTENT is not KC3 closed. An undecorated call was never a hole in this chain. The report does not answer which configuration produced the number.
Outside the fence
Semafide serves admissibility. It does not determine it.
10
Someone else decides
The examiner, the court, the carrier, the GSE decide what those facts mean for their dispute.
The report is not a verdict, a score, or a compliance certificate.
11
Whether anyone pays
Standing exists only when another institution changes its behavior because it accepts something Semafide said.
Unpaid until that happens. The remaining question is which missing historical fact has a buyer attached to it.
Two questions, one instrument
Count
Were all relevant executions disclosed? Completeness can speak to the chain that was handed over, against a checkpoint. It cannot see a call that never went through the decorator.
Configuration
Which settings produced this number? The verifier does not reconstruct that. If the provider cannot expose a digest at capture time, the commercial investigation is still open, and this sequence does not close it.