Claims backed by commands
TrustRail separates code evidence, deployment evidence, and independent evidence. A green unit test is never described as a customer-network proof or external certification.
| Evidence | Reproduce | What it proves |
|---|---|---|
| Repository gate | pnpm check | Runs 32 gates in one command: toolchain:check, scan:secrets, claims:check, facts:check, tasks:check, currency:check, problem:check, sql:check, truncation:check, rls:policy-coverage, rls:definer-check, control-surface:check, console-classes:check, findings:check, gate:parity, gate-order:check, scripts:check, open-boundary:check, capability:check, ra:gates:check, format:check, lint, build, canonical:differential, arb:verify:check, typecheck:workspace, test:unit, test:sdk-python, test:sdk-go, sdk-python:check, contracts:check, contract-security:check. |
| Database rehearsals | pnpm db:rehearse:m2 … m7-m9 | Clean-schema RLS, approval, execution, delegation, federation, and recovery properties. |
| Registry honesty | pnpm registry:check | Every EXECUTABLE claim has a provider descriptor, matching semantics, and reconciliation coverage — and every provider is classified PRODUCTION, SANDBOX or TEST, so a type that reaches only a test double is counted as executable in test, never as executable. |
| Artifact integrity | pnpm artifacts:check | Pinned repository evidence has not changed since its recorded review state. |
| ARB readiness | scripts/check-arb-readiness.ts | Logic checks run anywhere; an ENFORCE verdict additionally requires live probes from inside the workload. |
| Forensics game day | pnpm --filter @trustrail/forensics gameday | A deterministic 15,000-event synthetic exercise; not production incident performance or independent certification. |
Current Agent Runtime Boundary status in the reference checkout is OBSERVE: all seven logic checks pass, while live sole-route deployment evidence remains required.