Evidence

An evidence record is generated for a resolved incident. Generation is asynchronous: evidence_status moves from pending to ready, or to failed with a reason in evidence_error. A record is written once and never silently regenerated - if you need it rebuilt, POST /v1/evidence/{report_id}/regenerate creates a new one and records that it was rebuilt.

1. Incident record - the window, the dependency, severity, status, and the observation topology the measurements came from.
2. Detection record - the rule identifier, its reason string, and the run that satisfied it.
3. Incident window measurements - checks in window, successes, failures, blocked probes excluded, availability, longest failure run, latency, first and last observation.
4. SLA impact calculation - target uptime, measured availability, degradation impact, measured downtime, and the arithmetic basis for each.
5. Observed latency and failures - the chart, drawn from the rows in the appendix.
6. Rolling 24-hour health - context, labelled as context, never as the incident window.
7. Correlated dependency events - the other dependencies that failed nearby, by name.
8. Deterministic attribution - classification, confidence score, methodology version.
9. Documented observations - every observation in the window, individually, with timestamp, result, latency and status.
10. Authenticity, retention and verification - the payload hash, the document checksum, the verification URL, the signing status.

Evidence data hash

SHA-256 over the canonical payload - the incident’s facts as data, not as a rendered PDF.

Document checksum

SHA-256 over the rendered bytes. A PDF cannot contain the hash of itself, so the checksum lives on the record, not inside the document.

Signature

Ed25519 over the canonical payload bytes, when the deployment has a signing key configured. The public key is at /v1/verify/keys.

Records are retained for 365 days from issue. Sharing is by token: a recipient opens the artifact and its verification page without an account. The token is unguessable and carries capability, so treat a shared link as you would the document.

reliastra evidence list
reliastra evidence get 4b2e… --out incident-2026-09-18.pdf