AI Evidence Coverage Reportinternal
Every AI decision below carries cryptographic proof of which human reviewed it — re-verifiable by anyone holding the producer's public key, without trusting CarveTrace.
At a glance
| Period (UTC) | 2026-05-01T00:00:00Z → 2026-07-01T00:00:00Z |
|---|---|
| Decisions in period | 14 |
| Capabilities covered | 4 / 8 |
| Oversight coverage rate | 100.00 % |
| Producer ID | default-producer |
Decisions reviewed
Sampling strategy : most_recent — showing all 0 override/escalate and 7 gaps + 0 of 14 routine approvals + 7 standalone reviews (failures are NEVER sampled out).
✗ GAP — no human-in-the-loop binding on the chain for this decision.
An AI flagged this decision as 'good fit' (confidence 0.81). No human reviewer recorded an intervention on the chain for this decision.
If this decision is ever disputed, this row is not defended by a human-in-the-loop binding — you'd be relying on out-of-chain records. The chain-level verifier confirms the GAP below.
No cryptographic link present — the chain-level verifier confirms the GAP below.
Mechanics — hashes + runnable verify command
Re-derive yourself
$ carvetrace verify <bundle.zip> --public-key <producer.pem>
No HumanOversightEvent's inference_event_hash matches the inference hash above → reported as a binding GAP.
◇ STANDALONE — oversight present, bound inference is outside this sample window.
An AI flagged this decision as '—' (conf —). A human reviewer recorded an intervention bound to an inference outside this sample's window.
The oversight event is timestamped and signed regardless ; the bound inference is outside this sample window.
Binding present, bound inference outside sample — re-derivable against the full chain.
Mechanics — hashes + runnable verify command
Standalone oversight event ; bound inference is outside the sampled window. The event hash above is re-verifiable against the producer's chain regardless.
✗ GAP — no human-in-the-loop binding on the chain for this decision.
An AI flagged this decision as 'marginal' (confidence 0.55). No human reviewer recorded an intervention on the chain for this decision.
If this decision is ever disputed, this row is not defended by a human-in-the-loop binding — you'd be relying on out-of-chain records. The chain-level verifier confirms the GAP below.
No cryptographic link present — the chain-level verifier confirms the GAP below.
Mechanics — hashes + runnable verify command
Re-derive yourself
$ carvetrace verify <bundle.zip> --public-key <producer.pem>
No HumanOversightEvent's inference_event_hash matches the inference hash above → reported as a binding GAP.
◇ STANDALONE — oversight present, bound inference is outside this sample window.
An AI flagged this decision as '—' (conf —). A human reviewer recorded an intervention bound to an inference outside this sample's window.
The oversight event is timestamped and signed regardless ; the bound inference is outside this sample window.
Binding present, bound inference outside sample — re-derivable against the full chain.
Mechanics — hashes + runnable verify command
Standalone oversight event ; bound inference is outside the sampled window. The event hash above is re-verifiable against the producer's chain regardless.
✗ GAP — no human-in-the-loop binding on the chain for this decision.
An AI flagged this decision as 'good fit' (confidence 0.91). No human reviewer recorded an intervention on the chain for this decision.
If this decision is ever disputed, this row is not defended by a human-in-the-loop binding — you'd be relying on out-of-chain records. The chain-level verifier confirms the GAP below.
No cryptographic link present — the chain-level verifier confirms the GAP below.
Mechanics — hashes + runnable verify command
Re-derive yourself
$ carvetrace verify <bundle.zip> --public-key <producer.pem>
No HumanOversightEvent's inference_event_hash matches the inference hash above → reported as a binding GAP.
◇ STANDALONE — oversight present, bound inference is outside this sample window.
An AI flagged this decision as '—' (conf —). A human reviewer recorded an intervention bound to an inference outside this sample's window.
The oversight event is timestamped and signed regardless ; the bound inference is outside this sample window.
Binding present, bound inference outside sample — re-derivable against the full chain.
Mechanics — hashes + runnable verify command
Standalone oversight event ; bound inference is outside the sampled window. The event hash above is re-verifiable against the producer's chain regardless.
✗ GAP — no human-in-the-loop binding on the chain for this decision.
An AI flagged this decision as 'poor fit' (confidence 0.34). No human reviewer recorded an intervention on the chain for this decision.
If this decision is ever disputed, this row is not defended by a human-in-the-loop binding — you'd be relying on out-of-chain records. The chain-level verifier confirms the GAP below.
No cryptographic link present — the chain-level verifier confirms the GAP below.
Mechanics — hashes + runnable verify command
Re-derive yourself
$ carvetrace verify <bundle.zip> --public-key <producer.pem>
No HumanOversightEvent's inference_event_hash matches the inference hash above → reported as a binding GAP.
◇ STANDALONE — oversight present, bound inference is outside this sample window.
An AI flagged this decision as 'good fit' (conf —). A human reviewer recorded an intervention bound to an inference outside this sample's window.
The oversight event is timestamped and signed regardless ; the bound inference is outside this sample window.
Binding present, bound inference outside sample — re-derivable against the full chain.
Mechanics — hashes + runnable verify command
Standalone oversight event ; bound inference is outside the sampled window. The event hash above is re-verifiable against the producer's chain regardless.
✗ GAP — no human-in-the-loop binding on the chain for this decision.
An AI flagged this decision as 'good fit' (confidence 0.78). No human reviewer recorded an intervention on the chain for this decision.
If this decision is ever disputed, this row is not defended by a human-in-the-loop binding — you'd be relying on out-of-chain records. The chain-level verifier confirms the GAP below.
No cryptographic link present — the chain-level verifier confirms the GAP below.
Mechanics — hashes + runnable verify command
Re-derive yourself
$ carvetrace verify <bundle.zip> --public-key <producer.pem>
No HumanOversightEvent's inference_event_hash matches the inference hash above → reported as a binding GAP.
◇ STANDALONE — oversight present, bound inference is outside this sample window.
An AI flagged this decision as '—' (conf —). A human reviewer recorded an intervention bound to an inference outside this sample's window.
The oversight event is timestamped and signed regardless ; the bound inference is outside this sample window.
Binding present, bound inference outside sample — re-derivable against the full chain.
Mechanics — hashes + runnable verify command
Standalone oversight event ; bound inference is outside the sampled window. The event hash above is re-verifiable against the producer's chain regardless.
✗ GAP — no human-in-the-loop binding on the chain for this decision.
An AI flagged this decision as 'poor fit' (confidence 0.43). No human reviewer recorded an intervention on the chain for this decision.
If this decision is ever disputed, this row is not defended by a human-in-the-loop binding — you'd be relying on out-of-chain records. The chain-level verifier confirms the GAP below.
No cryptographic link present — the chain-level verifier confirms the GAP below.
Mechanics — hashes + runnable verify command
Re-derive yourself
$ carvetrace verify <bundle.zip> --public-key <producer.pem>
No HumanOversightEvent's inference_event_hash matches the inference hash above → reported as a binding GAP.
◇ STANDALONE — oversight present, bound inference is outside this sample window.
An AI flagged this decision as 'good fit' (conf —). A human reviewer recorded an intervention bound to an inference outside this sample's window.
The oversight event is timestamped and signed regardless ; the bound inference is outside this sample window.
Binding present, bound inference outside sample — re-derivable against the full chain.
Mechanics — hashes + runnable verify command
Standalone oversight event ; bound inference is outside the sampled window. The event hash above is re-verifiable against the producer's chain regardless.
✗ GAP — no human-in-the-loop binding on the chain for this decision.
An AI flagged this decision as 'marginal' (confidence 0.62). No human reviewer recorded an intervention on the chain for this decision.
If this decision is ever disputed, this row is not defended by a human-in-the-loop binding — you'd be relying on out-of-chain records. The chain-level verifier confirms the GAP below.
No cryptographic link present — the chain-level verifier confirms the GAP below.
Mechanics — hashes + runnable verify command
Re-derive yourself
$ carvetrace verify <bundle.zip> --public-key <producer.pem>
No HumanOversightEvent's inference_event_hash matches the inference hash above → reported as a binding GAP.
◇ STANDALONE — oversight present, bound inference is outside this sample window.
An AI flagged this decision as '—' (conf —). A human reviewer recorded an intervention bound to an inference outside this sample's window.
The oversight event is timestamped and signed regardless ; the bound inference is outside this sample window.
Binding present, bound inference outside sample — re-derivable against the full chain.
Mechanics — hashes + runnable verify command
Standalone oversight event ; bound inference is outside the sampled window. The event hash above is re-verifiable against the producer's chain regardless.
Capability summary
| Capability | Verdict | Events |
|---|---|---|
| Chain emission | COVERED | 14 |
| Operator-session integrity | GAP | 0 |
| Reference-data provenance | GAP | 0 |
| AI decision recorded | COVERED | 7 |
| Human-oversight recorded | COVERED | 7 |
| Retention attestation | GAP | 0 |
| Biometric-match provenance | GAP | 0 |
| Human-oversight verified | COVERED | 7 |
Per-capability detail
| Capability | Mechanism | Recommendation |
|---|---|---|
| Chain emission | Chain emission (any event ; recording capability) | |
| Operator-session integrity | AiSessionStarted.operator + OperatorSessionAudit.auditFromChain | No AiSessionStarted / AiSessionEnded pair resolves on chain ; configure operator-resolver and emit a session |
| Reference-data provenance | DatasetReferenceEvent on chain | No DatasetReferenceEvent ; emit one via `carvetrace dataset-reference` for each training dataset |
| AI decision recorded | AiInferenceEvent.input_data_reference or BiometricMatchEvent | |
| Human-oversight recorded | HumanOversightEvent + OversightBindingVerifier (binding-gated) | |
| Retention attestation | RetentionPolicyDeclaration / Enforcement / Proof on chain | No retention events ; declare via `carvetrace retention declare` (180-day minimum) |
| Biometric-match provenance | BiometricMatchEvent + BiometricMatchAudit.auditWithChain | No chain-resolved BiometricMatchEvent ; if biometric is in use, emit via the SDK helper with reference_database_event_hash bound to a DatasetReferenceEvent |
| Human-oversight verified | Article14Audit (binding-gated human oversight ; subsections oversight-bound, oversight-with-rationale, override-observed) |
Operational summary
Decision counts
Total events : 14
| Event type | Count |
|---|---|
| ai.inference | 7 |
| ai.oversight | 7 |
Decision-emitting model distribution (decoded sample)
| Model | Version | Count |
|---|---|---|
| facebook/bart-large-mnli | — | 7 |
Decision outcome distribution (decoded sample)
| Outcome | Count |
|---|---|
| good fit | 5 |
| marginal | 2 |
| poor fit | 2 |
Oversight coverage rate : 100.00 %
Cryptographic Integrity Verification
| Producer ID | default-producer |
|---|---|
| Producer key fingerprint | b6c2b33d2faccb42d1f9671ee970ee9695236eec72c5fb051fc01b835557d0a0 |
| Canonical hash | 860e77ebfc5b37d6871b421fc4d1081edd130b1c562201faea5c8232509bab49 |
| Signature algorithm | ECDSA-P256-SHA256 |
| Schema version | carvetrace.ai-evidence-coverage.v1 |
| Period from (HLC / UTC) | 1777593600000 / 2026-05-01T00:00:00Z |
| Period to (HLC / UTC) | 1782864000000 / 2026-07-01T00:00:00Z |
| Generated at (HLC / UTC) | 1781713544539 / 2026-06-17T16:25:44.539Z |
| TSA anchor count | 0 |
Hash appendix
Every truncated hash in Layer 2's dossiers is listed below with its full 64-char hex value, so any decision row can be cross-checked against the bundle's raw/events.proto without ambiguity.
| Label | Full hex |
|---|---|
| inference event hash (#0) | 9cf7c94717d38e45bbf1498404fd4a3a4b91c967acdc7d3971969bcb2ca61580 |
| model fingerprint (#0) | 0c7a705adc1bf0f08464e535e119a95e8f7db4d76c5d15566c699fc3ae7ab262 |
| input fingerprint (#0) | df5c315a7a944b27a7731069fae462978e80f78f211b980b8f290c32a26441b3 |
| policy hash (#0) | fd3043d31f29e1684b095704055c2c2c37445aa92ca3d2be05a2d4a8a16ec49c |
| inference event hash (#1) | 7ccd1d11e2e87ebe95b332da5fa9d9cdc242107eb0a0539a5593441a902b2cf0 |
| inference event hash (#2) | 4018b747b53f295bab0d393297b59b519e23d2ec05a7032eeac8d7c93cc2b8e1 |
| model fingerprint (#2) | 0c7a705adc1bf0f08464e535e119a95e8f7db4d76c5d15566c699fc3ae7ab262 |
| input fingerprint (#2) | ea87c4438d9e25657a8fbf61584ecfc4d164e76538e45eccf2c859560046d49f |
| policy hash (#2) | fd3043d31f29e1684b095704055c2c2c37445aa92ca3d2be05a2d4a8a16ec49c |
| inference event hash (#3) | 463a3b64bcc2c2fe0732450b1dddbdd5ade4a8b4f7713c07905391f807cb0879 |
| inference event hash (#4) | f6399fea25a36c645fa7b6ab6cb4d461831c0abbde09f65f2de83b29af6f74cb |
| model fingerprint (#4) | 0c7a705adc1bf0f08464e535e119a95e8f7db4d76c5d15566c699fc3ae7ab262 |
| input fingerprint (#4) | 3dcdc4565346a973c33fab2958de51f22f5a6aea0a27f82ac31dc414eca2723f |
| policy hash (#4) | fd3043d31f29e1684b095704055c2c2c37445aa92ca3d2be05a2d4a8a16ec49c |
| inference event hash (#5) | e34afdf7bd8fcaf55e72fe921c40280bb388d7f190a9a79a642c7591576a2b38 |
| inference event hash (#6) | 8a02c3cd6e6622cf76f6c434771e27fe72e120c5a4966a7af9cb3441bb44d4c1 |
| model fingerprint (#6) | 0c7a705adc1bf0f08464e535e119a95e8f7db4d76c5d15566c699fc3ae7ab262 |
| input fingerprint (#6) | 8ec8b4dba0643cf4afb0ac7354226b96898c021962f40137e97f03c8f69150fb |
| policy hash (#6) | fd3043d31f29e1684b095704055c2c2c37445aa92ca3d2be05a2d4a8a16ec49c |
| inference event hash (#7) | 6bb15a4bc2e52bfe6d04830feaefed88648098f2026aaff838418a3f48b924cc |
| inference event hash (#8) | d2ac77d276896de53c9c92e228dc1c8ac6f4bf6e16a8de6ba04452e1cee45661 |
| model fingerprint (#8) | 0c7a705adc1bf0f08464e535e119a95e8f7db4d76c5d15566c699fc3ae7ab262 |
| input fingerprint (#8) | 81c58802f8e20dce002ad2b2a1de787daa26035074f2f0e7228aac0e3352f92f |
| policy hash (#8) | fd3043d31f29e1684b095704055c2c2c37445aa92ca3d2be05a2d4a8a16ec49c |
| inference event hash (#9) | 80c90ce779ed1e9f9cbab854c6c0e4247bb4cbb699c61badccd5801c6f42c384 |
| inference event hash (#10) | 22fc1b80e9003e0fede7db1488a4e0cdc8e35fa728e56734e5573a8222224e85 |
| model fingerprint (#10) | 0c7a705adc1bf0f08464e535e119a95e8f7db4d76c5d15566c699fc3ae7ab262 |
| input fingerprint (#10) | f71a5faa0dea7ec8fe4bddcc2bcc06c0be34f17467af41162d1203f4021c07f5 |
| policy hash (#10) | fd3043d31f29e1684b095704055c2c2c37445aa92ca3d2be05a2d4a8a16ec49c |
| inference event hash (#11) | b695b5b2693a28698a1100e448fc815e450a76c3d71f62deaf99786f6e27074c |
| inference event hash (#12) | 2e4b5791dcbb0e06eca29329663fe24bba15048ba89b4df7b0340b0ae4615767 |
| model fingerprint (#12) | 0c7a705adc1bf0f08464e535e119a95e8f7db4d76c5d15566c699fc3ae7ab262 |
| input fingerprint (#12) | 837bd34157bd3482f1099936f985058f67a83c50a44111d0c0f341e95be60257 |
| policy hash (#12) | fd3043d31f29e1684b095704055c2c2c37445aa92ca3d2be05a2d4a8a16ec49c |
| inference event hash (#13) | 9bcbe0091f5045f082980e3f3381f35ef3e77566531262eb06ab6167dc5f53da |
Independent Verification
The contents of this report can be verified offline. The verifier checks : (1) the canonical SHA-256 hash of the report payload matches the value in the embedded Attestation ; (2) the ECDSA P-256 signature verifies under the supplied public key ; (3) every TSA anchor's chain-head value is consistent with the chain-root recomputation ; (4) every human-oversight event hash listed under Framework Mapping is independently re-derivable as bound to an ai.inference event via the WASM verify_oversight_binding entry point on the bundle's raw/events.proto — human-oversight verification is checkable, not asserted.
Maven coordinates : ma.aryamind:carvetrace-verify (Apache 2.0, available from Maven Central).
Cryptographic attestation embedded in the document head as base64-encoded AiEvidenceCoverageReport proto bytes. Verify offline with carvetrace verify <file>.