Claims backed by commands

TrustRail separates code evidence, deployment evidence, and independent evidence. A green unit test is never described as a customer-network proof or external certification.

Evidence	Reproduce	What it proves
Repository gate	`pnpm check`	Build, lint, formatting, typechecking, unit coverage, SDK tests, contracts, and secret scan.
Database rehearsals	`pnpm db:rehearse:m2 … m7-m9`	Clean-schema RLS, approval, execution, delegation, federation, and recovery properties.
Registry honesty	`pnpm registry:check`	Every EXECUTABLE claim has a provider descriptor, matching semantics, and reconciliation coverage.
Artifact integrity	`pnpm artifacts:check`	Pinned repository evidence has not changed since its recorded review state.
ARB readiness	`scripts/check-arb-readiness.ts`	Logic checks run anywhere; an ENFORCE verdict additionally requires live probes from inside the workload.
Forensics game day	`pnpm --filter @trustrail/forensics gameday`	A deterministic 15,000-event synthetic exercise; not production incident performance or independent certification.

Current Agent Runtime Boundary status in the reference checkout is OBSERVE: all seven logic checks pass, while live sole-route deployment evidence remains required.