EV424
REPRODUCIBLE ONLY
Evidence Policy
Evidence Policy
Verification uses only official sources with clear provenance.
If the official bytes change, the SHA-256 fingerprint changes — and the change is detected.
Policy summary
- Non-reproducible data is rejected.
- Verification uses only official sources with clear provenance.
- Only re-verifiable evidence is preserved.
Key definitions
Official source
Publisher-controlled original
The original document published and controlled by the issuer (organization/company/project) on an official channel.
REPRODUCIBLE ONLY
Same input → same output
Same official bytes + same rules must reproduce the same fingerprint and receipt.
No PDF mirroring
Publish verification, not redistribution
EV424 publishes URL, SHA-256 fingerprint, re-verify method, and receipt — not the original PDF content.
How users verify
Exact-match lookup
Public search accepts only Evidence ID (EV424-ENTRY-0000xx) or a 64-hex PASS hash.
How reproducible verification closes
- Confirm an official source URL with clear provenance
- Compute SHA-256 from the official bytes
- Re-download check: the SHA-256 must match
- Lock the record: same input must not drift
- Close as a re-verifiable receipt
Rejected examples
- Anything that cannot be re-downloaded from an official source
- Reuploads/copies/screenshots that replace the official original
- Standalone claims without a verifiable official original
Open3 documents
- Safe-Rail Policy (Integrity-only) — SSOT v1.3 (EN) + sha256 re-verify
- Safe-Rail (EN) SHA256:
60cb80ce25907289cffc629f2c7a5cdf6bea5c61e29ecc5bcf6c16076f00fc01 - Re-verify:
sha256sum -c <file>.sha256