Technical docs
Evidence Model
Evidence states, generated artifacts, provenance chains, and additive corroboration rules.
Evidence states
Docs use consistent evidence states across UI, visuals, and exports.
- Direct: supported by retained source evidence.
- Inferred: reasoned from adjacent evidence and shown with limits.
- Missing: an expected record, file, or path is not present.
- Unavailable: a surface or record cannot currently be loaded or read.
- Absent: the case explicitly indicates no evidence in this category.
- Unsupported: the evidence shape is outside the current supported contract.
- Warning: review can continue, but a parser, runtime, validation, or degraded-state caution exists.
- Contradiction: retained signals conflict and need reviewer attention.
- Uncalibrated: validation or confidence is not strong enough for stronger confidence language.
- Review-only: existing case review is available while privileged operations may be disabled.
Generated case directory
The generated case directory is the stable interface between parser workflows and review surfaces. Public docs should describe artifact families without publishing raw JSONL or raw evidence.
- Discovery manifests and normalized records.
- Sensitive-material matches and exposure reconstruction.
- Agent sessions, actions, artifacts, and browser continuity.
- Timeline, cross-device, geospatial, and corroboration artifacts.
- Enterprise import records, evidence gaps, review signoffs, role-specific reports, validation outputs, and provenance bundles.
Provenance chain
A strong finding should be traceable from source path to raw record or locator, normalized record, workflow artifact, UI or report display, review state, and export bundle.
- Show chain-of-custody style traceability rather than magic answer language.
- Keep source-native review available as the authoritative verification path.
- Show caveats near claim-heavy visuals instead of hiding them in footnotes.