Skip to content
Docs
ChangelogPricingOpen console

Guides

Evidence graph

The evidence graph is everything a release decision rests on, written as typed nodes and typed edges in one JSON file. It holds the system, suite and evaluator versions a run evaluated, the estimates computed from it, the decisions that read them under a policy, the sign-offs that approved them, the hazards they measure, the claims of the assurance case they support and the formal results beside them. It also names where the evidence is incomplete, out of date or in conflict, so a reviewer sees the gaps before reading anything else.

Drawing it

oloproof evidence graph --out graph.json
oloproof evidence graph run_01J9 --out run.json
oloproof evidence graph --record decision-record.json --out record-graph.json

Without a run, the graph covers each system's latest run of each suite, the same runs the hazard register and the assurance case are read against. With a run id, it covers that run and every claim that reads it. With --record, it is drawn from a decision record file alone, so a second party can see what the record carries without your store; what the record only names (its hazard register and its assurance case, by digest) is listed in the notes. Without --out the graph is printed.

What is in it

The file says "graph": "oloproof.evidence_graph/v1". Each node has an id (typed, such as run:run_01J9 or decision:run_01J9/label-floor), a type, a label, attributes (a state, an interval, a digest) and a basis, what it rests on:

  • computed by the engine from recorded evidence: an estimate with its interval, a decision;
  • signed by a registered runner, whose signature oloproof record verify checks;
  • attested by named people: the release policy, a sign-off, a hazard, a claim;
  • imported from another tool: scores read by oloproof scores import, a solver's result.

The node types are system_version, suite_version, evaluator_version, run, estimate, decision, policy, signoff, hazard, claim and proof. The edges are typed too: a run evaluates a system version and runs on_suite a suite version; an estimate is computed_from a run and judged_by an evaluator version; a decision reads an estimate under_policy a policy; a sign-off approves a decision; a hazard is measured_by a decision; and a claim is supported_by decisions, hazards, formal results and its sub-goals.

What it reports

  • dangling: an edge whose target the graph does not hold, with why. A hazard that names a rule a run did not decide, or a decision whose metric has no stored result, shows up here rather than disappearing.
  • stale: a run whose evidence no longer matches what it is compared with, with each reason and every node that rests on it. Locally a run is compared with the project as it is now; in the workspace, and with no project file, with the store's newest run of the same system and suite. A graph drawn from a record reports nothing stale, since there is nothing to compare it with.
  • contradictions: two formal results for one property and one model that disagree, and a claim argued from evidence that fails.

Nothing in the graph decides anything: the states are the engine's decisions, and a claim's status is the one oloproof assurance check reports.

In the workspace

A run's evidence page offers the graph for download, drawn by the engine from the evidence you pushed, beside the decision record of a governed run.

Where to go next