Evidence Packet

Tier: 3 · Normative weight: implements TM-EVD-002, TM-EVD-003, TM-EVD-007 Requires: Evidence Hygiene

Problem it removes

A screenshot in a chat, a pasted terminal block, a file named final2.xlsx — the claim survives but its provenance does not. Later no one can say where the evidence came from, whether it was altered, or what it was ever supposed to prove.

Mechanism

One directory per capture, named for a stable packet id, holding the captured files beside a manifest.toml that records: the id, kind, capture date, source, the SHA-256 of every retained file (TM-EVD-007: detectable substitution), and an auditability class. Source representation is preserved where policy permits; where it cannot be, the manifest records what was observed, by whom, and why the original is unavailable (TM-EVD-002). The provenance fields — source, capture event, integrity mechanism, transforming actors — are TM-EVD-003 made into TOML keys.

The manifest’s authority field is the discipline that pays: two clauses, “supports X; does not prove Y.” Writing the second clause is what keeps evidence from quietly inflating into conclusions.

Cost

Authoring: the schema exists; the first packet takes minutes. Per change: one manifest per capture — digests are one command. Per session: none; packets are read when a claim is questioned.

Do not adopt when

Git already versions and reviews the material — evidence packets for source-code truth duplicate commits. The pattern is for truth Git does not govern.

Evidence

Assessed in kinra-corpus and used by the reference instance’s own history (frozen, per its charter). The flow evidence store applies the same semantics inside an application. Validated by evidence.schema.json.

Template

templates/evidence-packet/manifest.toml

Related patterns

Change Packet is what cites the packet; evidence that nothing will ever cite may not need packeting at all.