Check us.
Every factual line on this site maps to a file or a command in the repository. Each row was checked by opening the file or running the command, because our own documentation has been stale before.
The claims that bear the load.
Each of the 30 rows below names its source. The fuller map is
site/verify/CLAIMS-MAP.md.
| Claim | Verified against |
|---|---|
| The Mac app and the Windows installer carry their licence and their third party notices. | Contents/Resources/LICENSE, NOTICE and THIRD-PARTY-NOTICES.txt in the app · files\ in the Windows installation · written by packages/desktop/tools/build-app.mjs and build-windows.mjs |
| The third party packages bundled into the app are under permissive licences (MIT, ISC, BSD); none is copyleft. | THIRD-PARTY-NOTICES.txt in the 0.6.1 app, generated by packages/desktop/tools/third-party-notices.mjs (90 entries, 26 October 2026) |
| The OATR spec text is CC BY 4.0, separate from Evidren’s code. | signat/spec/OATR-v0.1-DRAFT.md licence header · signat/NOTICE |
12 packages, every one private: true. None is on a package registry. | packages/*/package.json |
| Milestones M1 to M4 certified by a separate internal review role rerunning the gates; not rerun since the D27 ruling of August 2, 2026. | handoff/DECISIONS.md · the GATE M1/M2/M3/M4 and D27 entries |
The gate scripts test the built dist/ output, not the source. | signat/.github/workflows/ci.yml · node scripts/gate-m4.mjs → 19/19 |
| Each line holds the sha256 of the previous line’s raw bytes, and an HMAC seal, compared in constant time, covers the tail. | packages/core/src/audit.ts:34, :269, :373 (links) · :54-65, :401, :439 (seal, timingSafeEqual) |
Redaction references are HMAC-SHA256 digests under a per install key, mode 0600. Recognised secrets are never stored raw in the record; unrecognised ones are. | packages/core/src/redaction.ts:69-86 · round3/smuggle-run.txt |
The shipped default is 4 rules with onUnmatched: allow; a test keeps it so. | policies/default.yaml · packages/core/test/shadow.test.ts |
26 rules in the command-risk detector across 6 categories; 11 named credential patterns. | packages/detectors/src/command-risk/rules.ts · secrets/patterns.ts |
git push --force asks; --force-with-lease and --force-if-includes do not prompt. | policies/default.yaml · the force-push-needs-approval regex |
| 81 adversarial commands at this build: 57 handled, 24 silently allowed, 0 false positive (July 31, 2026: 26 and 41 of 68). Download then execute (5 of 5), self disarm (7 of 7) and interior quoting are caught. | node scripts/adversarial-command-risk.mjs · rules staged-remote-exec and evidren-self-tamper (signat-self-tamper before September 21, 2026) · normalizeToken() in shell.ts · D27 |
| The shipped default interrupts 0 of 40 ordinary developer commands; the proposed stricter profile, 4 of 40, all as asks. | node scripts/shadow-fp-check.mjs |
| Seven further rules are drafted, not shipped. On the July 31, 2026 corpus they would have stopped or queried 16 of the then remaining 25; not rerun since. | evidren shadow · handoff/RULESET-REVIEW.md (P2, P3 and P5 to P9 unchecked) |
evidren init wires the hooks, stamps a coverage manifest and requires the hook to deny a destructive payload. It says this does not prove the assistant calls it. | evidren init against a fresh --home · packages/cli/src/cli.ts (cmdInit) |
evidren verify prints its own boundary: it proves the recorded lines are unaltered and untruncated, not that the record is complete. | evidren verify against a fresh --home · packages/cli/src/cli.ts (cmdVerify) |
evidren card renders a redacted incident card: the rule, the moment and the coverage boundary, never the command, path or argument. | evidren card · packages/cli/src/cli.ts (cmdCard) |
| The verifier page rechecks every digest and chain link in your browser. Nothing is uploaded. | site/src/pages/verifier.astro (crypto.subtle.digest, no backend) |
| Claude Code: verified on 24 Oct 2026 with Claude Code 2.1.310 on macOS. | packages/integrations/src/ (claude-code) |
| GitHub Copilot CLI: verified on 24 Oct 2026 with GitHub Copilot CLI 1.0.103 on macOS. | packages/integrations/src/ (copilot-cli) |
| OpenAI Codex CLI: not verified. | packages/integrations/src/ (codex) |
| The VS Code extension connects folders and shows the record; the hook does the intercepting. It is not on the Marketplace. | packages/vscode/src/extension.ts · packages/product/src/ |
| Telemetry is two streams, both off by default, with no endpoint configured; the flush transport is a stub. | node scripts/gate-m4.mjs criterion (c) · handoff/DECISIONS.md D24 Δ3 |
A third party can recheck an exported pack with shasum alone, but not the HMAC seal; the manifest says so in externallyVerifiable. | packages/core/src/evidence.ts:261 · DEMO_PAUSE=0 bash demo/evidence-demo.sh |
| The Evidence Pack asserts no ISO 42001 or EU AI Act mapping; a test fails if a conformity claim appears. | packages/core/test/evidence.test.ts |
The recording on /companies is a real run. evidence-demo.sh checks every beat that has a check and exits nonzero if one fails. | DEMO_PAUSE=0 bash demo/evidence-demo.sh → exit 0 |
| One engine, one adapter per agent tool. Verified with Claude Code and GitHub Copilot CLI only; OpenAI Codex CLI is registered, not verified. | packages/integrations/src/ · D33 in handoff/DECISIONS.md |
The download page serves the Windows installer and the browser extension built in CI run 43 from commit 296771c. The size and sha256 beside each file are computed from the file served when the site is built, and the build fails if a file is missing or differs from the manifest. Not verified with signed in accounts. | site/public/download/manifest.json · site/src/lib/downloads.ts · site/tools/fetch-downloads.mjs · CI run 43 of the product repository, all eight jobs green |
| The privacy page: the browser extension makes no network requests of its own, keeps a record of its decisions without the text, a value or a file name (at most 5,000 entries), and hands the text it checked only to the Evidren app on the same computer, which keeps a mask in its place. Evidren has no server that receives it; telemetry is off with no address set, and the team transfer is off in this version. | packages/browser/src/records.ts, sw.ts, content/index.ts, build.mjs · packages/desktop/src/browser-host-core.ts · packages/core/src/telemetry.ts · packages/team/src/client.ts (TEAM_TRANSFER_APPROVED = false) · their tests, run on 23 October 2026 |
| The homepage picture is Evidren 0.5.0, built on 21 Sep 2026 from the tree committed as e6b53e2 and photographed by the app itself in an isolated home. The build fails if the app or the picture differs from that record. | site/tools/make-app-home.mjs then site/tools/shoot-app.mjs · site/src/lib/appshot.ts (sha256 of the app’s files and of the picture) |
What we are not allowed to say.
Each line below is something a marketing pass would reach for. Several appeared in our own earlier material until this check caught them.
| Barred | Why |
|---|---|
| Evidren is a commercial product. Copies of 0.6.1 and earlier keep the licence they were released under; that does not make the product open source. | |
| None of the 12 packages is on a registry; Evidren is installed from the downloads on this site. An install line would fail. | |
| Stale; the count and the commit are derived at build time. | |
| Stale since D27: all seven are denied. An obfuscated path still evades the rule. | |
| The certifying role is internal, not an external auditor, and has not rerun since D27. | |
| No certification or third party audit exists. Only “designed to support evidence requirements” is permitted. | |
| None is published. | |
| Anything outside Bash, Write, Edit, Read and routed MCP leaves no line, and verify still passes. | |
| Claude Code is the one verified integration, not what the product is. | |
| None is covered. Claude Code is not Claude Desktop; Copilot CLI is not Microsoft 365 Copilot. | |
| No measurement supports either as a general claim, and there is no managed install for an organisation. | |
| The metaphor implies complete, mandated capture. A missing line proves nothing. | |
| Tamper evident: the chain detects alteration. It does not prevent it. | |
| On July 31, 2026 the 42 misses were 41 silent allows and one false positive. |
Then the page is wrong, and it changes.
The corrections in the barred table were found by testing our own copy against the code, not by an outsider. If a claim here does not survive contact with the repository, it comes off the site.