Decision evidence file

An evidence file gathers everything that produced a decision, in a form that a third party (committee, auditor, statutory auditor, regulator) can verify without trusting the platform. It is computed on demand from an evaluated application, whose decision and trace no longer change; NEXCLARA keeps no copy of it. TRUST is still being delivered: this first slice is available through the API only.

Exporting

The export is an operation of the "applications" family of the API reference. It requires the right to read the application, and it is written to the institution's audit trail with the fingerprint of its manifest. An application that was never evaluated has no evidence, and the read-only support identity of an exceptional access cannot export.

The file is a JSON document in canonical form: sorted keys, no whitespace, no floating-point numbers (decimals are strings), UTC instants. Its bytes must not be reformatted: verification refuses a file that is not its own canonical form.

{
  "format": "nexclara-decision-evidence@2",
  "manifest": { "...": "..." },
  "manifest_sha256": "<64 hexadecimal characters>",
  "parts": { "...": "..." },
  "signature": null
}

What the file contains

Value-level provenance. For an application imported by LINK, each value states what the import recorded: batch, row, column, conversions, missing status, contract version, times, and the SHA-256 fingerprint of the original file, which lets the institution recognise it. A value changed in DESK after the import, before submission, is stated as "differs from import" and is not attributed to the file. No value of the file is copied into this part. An application entered directly in DESK is declared "direct entry": it has no external source, and that is not a gap. Evidence files issued before 16 October 2026 (format @1) declared this provenance unavailable; they remain verifiable.

The manifest lists each part with its SHA-256 fingerprint and size, the status of the file (complete or incomplete, deduced from the parts), the gaps and the limitations: what the evidence does not prove. Rights apply: without the right to read the scorecard scale, the scorecard points are withheld and the withholding is declared.

Signature and verification

When the instance has its key, the manifest is signed with Ed25519. The public key attached to the file is a convenience, not a proof of identity: a signature is authentic only when checked against a key obtained through another channel.

Verifying a file means checking: the canonical form, the manifest fingerprint, the fingerprint and size of each part, cross-references between parts, the consistency of value-level provenance, the fingerprint of each disclosed policy and the signature. NEXCLARA has a reference verifier written with the Python standard library only, which states on every run what it cannot verify; making it available to institutions is not organised yet.

What is still under construction

• no committee PDF is produced, and no screen offers the export;
• whether value-level provenance matches the original file can only be checked with that file, which only the institution holds;
• the audit trail is tamper-evident, not tamper-proof: no external anchoring and no third-party timestamping;
• without a configured instance key, the file is not signed, and says so;
• retention periods are provisional until the institution's administrator confirms them, and no purge by expiry takes place before that confirmation; an accepted erasure request, however, is applied without waiting for a confirmed period. After a purge, the application's raw inputs are erased: the evidence file then declares the "inputs" and "reconstitution" parts unavailable, reason inputs_purged, and records the limitation of the same name; decision, trace, explanations and fingerprints remain.