{
  "schemaVersion": 1,
  "product": "Punk",
  "canonicalUrl": "https://punktechnologies.com/marketing-pages/trust/evidence-registry-v1.json",
  "reviewedAt": "2026-07-28",
  "policyUrl": "https://punktechnologies.com/docs/evidence-contract",
  "evidenceClasses": {
    "implemented": "Current product behavior supported by source or tests, with configuration and enforcement boundaries.",
    "measured_reference": "A synthetic, demo, or controlled result with a public protocol, denominator, result record, failures, exclusions, and limitations.",
    "customer_measured": "A customer result with approved attribution or anonymization, method, denominator, period, and publication consent.",
    "external": "A claim grounded in a dated primary external source.",
    "proposal": "A design, target, or roadmap item that is not represented as shipped or achieved.",
    "opinion": "A named author's interpretation; embedded facts still require evidence.",
    "not_claimed": "A capability, certification, outcome, or commitment that the available evidence does not establish."
  },
  "quantitativeClaimRequirements": [
    "unit",
    "population",
    "denominator",
    "measurement date",
    "code or product version",
    "failures and exclusions",
    "material configuration",
    "limitations"
  ],
  "claims": [
    {
      "id": "route-explanation-per-response",
      "class": "implemented",
      "statement": "Punk records a RouteExplanation for served gateway responses, naming the selected route, reason, rejected alternatives, and route-specific evidence when applicable.",
      "evidence": [
        "https://punktechnologies.com/docs/evidence-contract#route-explanation-contract",
        "https://github.com/PunkTechnologies/punk/blob/main/packages/trace-schema/src/index.ts"
      ],
      "boundary": "The explanation records a routing decision; it does not by itself prove answer correctness or activity that bypassed Punk."
    },
    {
      "id": "declarative-artifact-dsl",
      "class": "implemented",
      "statement": "Punk reusable artifacts are interpreted versioned data, not generated or evaluated source code.",
      "evidence": [
        "https://punktechnologies.com/docs/evidence-contract#declarative-artifact-contract",
        "https://github.com/PunkTechnologies/punk/blob/main/packages/artifact-core/src/index.ts"
      ],
      "boundary": "Hybrid artifacts may invoke an explicitly supplied model fallback; all artifacts remain subject to runtime bounds and current eligibility checks."
    },
    {
      "id": "replay-shadow-promotion-gate",
      "class": "implemented",
      "statement": "Punk separates historical replay, current-traffic shadow evaluation, promotion eligibility, and automatic-promotion authority.",
      "evidence": [
        "https://punktechnologies.com/docs/evidence-contract#promotion-contract",
        "https://github.com/PunkTechnologies/punk/blob/main/packages/replay-core/src/index.ts",
        "https://github.com/PunkTechnologies/punk/blob/main/packages/learning/src/index.ts"
      ],
      "boundary": "Default thresholds are product defaults, not universal safety guarantees; deployment policy and human approval can impose stricter requirements."
    },
    {
      "id": "github-issue-plan-reference-result",
      "class": "measured_reference",
      "statement": "In the published July 13, 2026 reference workload, 50 held-out treatment requests produced 50 exact plans with zero treatment model calls.",
      "evidence": [
        "https://punktechnologies.com/proof/github-issue-plan-reuse",
        "https://punktechnologies.com/marketing-pages/proof/github-issue-plan-reuse/protocol-2026-07-13.txt",
        "https://punktechnologies.com/marketing-pages/proof/github-issue-plan-reuse/result-2026-07-13.json",
        "https://punktechnologies.com/marketing-pages/proof/github-issue-plan-reuse/reproducibility-2026-07-13.json"
      ],
      "boundary": "Public GitHub reference workload; not a customer deployment, not a provider invoice, not an endorsement, and only partially reproducible from public historical material."
    },
    {
      "id": "formal-certifications",
      "class": "not_claimed",
      "statement": "Punk does not claim a completed SOC 2, ISO 27001, HIPAA, or other formal compliance attestation.",
      "evidence": [
        "https://punktechnologies.com/trust",
        "https://punktechnologies.com/docs/trust"
      ],
      "boundary": "Customer-specific contracts, deployment evidence, and independent attestations require separate review."
    }
  ]
}