{
  "schemaVersion": "1.0",
  "title": "Punk enterprise evidence checklist",
  "reviewedAt": "2026-07-20",
  "purpose": "A compact review map. It distinguishes current product evidence from deployment-specific proof, unavailable evidence, and benchmark-only evidence. It is not a certification, legal commitment, or customer-specific security addendum.",
  "claims": [
    {
      "claim": "A run can expose route explanation, trace-integrity verification, audit material, and an evidence packet.",
      "currentEvidence": ["/docs/trust", "GET /api/v1/runs/:id", "GET /api/v1/runs/:id/integrity", "GET /api/v1/runs/:id/evidence-packet", "GET /api/v1/audit"],
      "reviewAction": "Export and inspect a representative deployment run; confirm tenant/app/agent/subject context and the configured route.",
      "gapOrBoundary": "Evidence quality, retention, and export completeness depend on the deployed configuration and traffic."
    },
    {
      "claim": "Artifact promotion is designed to require replay and shadow evidence; replay and shadow suppress side effects.",
      "currentEvidence": ["/docs/trust", "/proof/github-issue-plan-reuse"],
      "reviewAction": "Review the artifact's replay, shadow, policy, fallback, rollback, and side-effect evidence for the proposed workload.",
      "gapOrBoundary": "The public benchmark is a narrow, Punk-sponsored read-only reference result, not customer proof or a guarantee for another workflow."
    },
    {
      "claim": "Tenant settings and policies can govern retention, redaction, learning, providers, and tool side effects.",
      "currentEvidence": ["/trust", "/docs/trust", "GET /api/v1/readiness"],
      "reviewAction": "Capture tenant settings, policy summaries, enabled connectors, provider-key source, and approval posture before production traffic.",
      "gapOrBoundary": "A control may require explicit deployment configuration; provider terms and deployment infrastructure remain separate review items."
    },
    {
      "claim": "Credential secrets are AES-256-GCM encrypted when PUNK_ENCRYPTION_KEY is valid before storage.",
      "currentEvidence": ["/trust", "/docs/trust"],
      "reviewAction": "Verify key configuration before storing credentials and collect deployment evidence for transport, database, disk, backup, and key-rotation posture.",
      "gapOrBoundary": "This does not establish encryption posture for the database, disks, backups, provider, or edge."
    }
  ],
  "notClaimed": [
    "SOC 2, ISO 27001, HIPAA, or another formal compliance attestation",
    "Public SLA, incident-notification SLA, data-residency commitment, BAA, customer-managed keys, database row security, SSO, SAML, or SCIM",
    "A public subprocessor list, provider-side no-retention/no-training guarantee, or customer-specific contractual commitment",
    "Customer logos, customer case studies, customer realized savings, or benchmark results as customer outcomes"
  ],
  "minimumPilotPacket": [
    "Readiness receipt and a representative run evidence packet",
    "Audit export for the review window and policy summary",
    "Tenant settings evidence for retention, redaction, DLP, learning, and side-effect approvals",
    "Provider-key source, enabled connector manifest excerpts, and deployment backup/restore evidence",
    "Rollback/quarantine drill notes and a list of unresolved evidence gaps"
  ],
  "referenceBenchmark": {
    "url": "/proof/github-issue-plan-reuse",
    "reproducibilityManifest": "/marketing-pages/proof/github-issue-plan-reuse/reproducibility-2026-07-13.json",
    "boundary": "Public files verify frozen artifact integrity and aggregate arithmetic only; the original provider-backed run, raw report, and historical source are not publicly reproducible."
  }
}