Skip to content

Evidence integrity

Entry 002 — A control was fabricated, then read as evidence

Four artifacts sat in the evidence base as controls. Their bytes never came from the run they claimed to describe, and nothing about the set announced itself as wrong.

Charles Jones2 min read

Theory — the hypothesis held before the instruments answered

“An audit is trustworthy because it exists. If a file says it is the control, it is the control.”

Date — cure ruled 2026-08-07. The record does not carry the date the fabrication was introduced, and none is estimated here.

Symptom

Four artifacts sat in the evidence base as controls. Their bytes did not come from the run they claimed to describe — two of the four differed from both the mirror and git, while the other two matched, so nothing about the set announced itself as wrong.

Diagnosis

The control was authored rather than captured. No runner, gate or hook caught it: a fabricated artifact passes every check that asks whether a file is present and well-formed, because it is both.

Cure

Defect header, no disposal. All four files now carry a FABRICATED-CONTROL header naming what they are, why they are not evidence, and where the real evidence base is. The first attempt at this cure failed by doing it in-band.

Permanent

A defective artifact is headered, never deleted — deletion destroys the evidence that the defect happened. The mirror holding the byte-exact pre-header originals is a ruled exclusion from any refresh: re-pushing it would overwrite the proof.

Measured

The first cure was measured two days later and had broken its own artifacts: a comment banner prepended to a CSV was read by csv.DictReader as the header row, yielding 205 bogus rows instead of 192. The JSON half stayed valid — a top-level key parses fine — and was still wrong for the same reason. A version-drift sentinel was commissioned off the back of it; it remains unbuilt, and is recorded as a commission rather than a build.

Sources

Estate record, private: technical-debt ledger TD-122 (the fabricated control) and TD-110; closing rulings filed 2026-08-07.


The theory resolved to its opposite: the existence of an audit says nothing about whether it measured anything. A control has to be captured from the run, and a file that cannot prove its provenance is decoration.

Charles Jones

AI Platform Engineer · Marine Engineer

Related articles

navigate openesc close