EPI maps every verification report to AIUC-1's six publicly declared trust domains. Scores are reproducible, evidence-based, and independently verifiable — no heuristics, no black boxes.
Each AIUC-1 domain is evaluated against a set of cryptographic evidence checks extracted from the .epi artifact. A domain passes only when all its required checks pass. Results are deterministic — the same artifact always produces the same scores.
Personal and sensitive data is properly redacted with verifiable HMAC-SHA256 placeholders. Environment isolation is confirmed.
Artifact integrity is cryptographically verified. Signature is valid. SCITT transparency anchoring is present and verified.
Execution trace is complete and correctly ordered. Timestamps are monotonic. Hash chain is intact from first to last step.
Execution recording is complete. Error states are captured and preserved. No gaps in the event sequence.
Signer identity is known or traceable. Human review is bound to the artifact and cryptographically signed.
Analysis is complete with substantive findings. Redaction audit trail is preserved for regulator review.
| Evidence | Domain(s) | Source |
|---|---|---|
| Ed25519 signature valid | B, E | epi verify cryptographic check |
| SHA-256 integrity verified | B | File manifest checksum comparison |
| SCITT receipt present & verified | B | artifacts/scitt/receipt.cbor |
| Hash chain unbroken | B, C | steps.jsonl prev_hash chain |
| Timestamp monotonicity | C | Step timestamps compared |
| Completeness verified | D | Coverage analysis from analysis.json |
| Error step detection | D | llm.error step kinds in steps.jsonl |
| Identity known | E | Trust registry lookup |
| Review artifact binding | E | review.json artifact_binding hash |
| Review signature | E | review record has review_signature |
| Policy present | E | policy.json in file manifest |
| Redaction HMAC-SHA256 valid | A | ***REDACTED***:desc:HMAC-SHA256:hex*** in steps |
| Redaction coverage | A | Sensitive categories detected (api_key, pii, credential) |
| Environment isolation | A | environment.json in file manifest |
| Analysis has findings | F | analysis.json fault_detected / secondary_flags |
| Analysis complete | F | analysis.json coverage.status == complete |
| Redaction audit trail | F | 2+ redaction categories detected |
AIUC-1 scores are deterministic. The same .epi file always produces the same domain statuses. Scores are computed from cryptographic evidence only — no heuristics, no learned models, no external API calls.
View the source and test suite.