The evidence lab

Abstract

A read-only collector writes what it sees, with a checksum beside every file. A judge that cannot see the estate reads only those files and decides one of four verdicts, honest about what it could not see. A ledger chains every verdict, and only a reviewer who is not the builder can sign. Change what can be read, change what happened, then try to cheat at every step.

A denied read is a gap, never an empty result; and a verdict nobody independent has checked is a claim, not evidence.

Its figure in the paper: § III.C →

Collector
read-only
idle
Files
checksum beside each
none
Judge
cannot see the estate
waiting
Ledger
the only authority
0 receipts
Reviewer
not the builder
0 signed

What the collector can read · day 1

Workpiece	Inventory *	Configuration *	Access policy *	Activity log	Outside probe
Public front door
Internal reporting
Partner exchange
Data warehouse

* required for coverage. A required source that is denied or fails makes the verdict unknown.

Something unpermitted happens in the window

The files

Nothing collected yet.

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 8 attempted · 0 refused

Report a denied read as empty
The collector is refused the configuration, and the result is treated as if there were nothing to see.
Prove it with configuration alone
Nothing can be observed in the window, so the configuration is offered as proof of what happens.
Edit a file after it was collected
One byte of a raw file is changed before the judge reads it.
Call it healthy while something unpermitted happens
A path the configuration never permits is observed, and the workpiece is reported as fine.
Judge nothing and call it clean
Nothing is configured at all, so there is nothing to fail.
The builder signs its own receipt
The identity that ran the judge offers its own signature.
Sign one receipt, then change it
A reviewer signs; the receipt is altered afterwards and the old signature is presented for it.
Rewrite yesterday's verdict
An earlier verdict in the ledger is changed in place.

Setting up the instrument…

Declared limits

The estate is four illustrative workpieces with invented paths.
Observation here is a switch; a real witness is logs and probes over a window, and absence in a window means unobserved, not unused.
The ledger is hash-chained in the browser; it shows tamper evidence, not tamper proofing.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § III.C

Exposure paths →

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →