Review Cohesix evidence

Answer what happened, which source establishes it, and what remains unknown. Prefer an existing recorded pack before contacting a live system. Capture and analysis are separate from acceptance under the Test Plan.

Select the source and tools

Recorded-pack review and live capture can run on macOS or Linux with the matching host installation. Resolve COH_BIN to its absolute executable directory from the installed receipt or extracted bundle; these commands do not require a bundle-root working directory. Identify its version, manifest and command help before using these source-oriented examples. If the host binary, pack schema or verifier is incompatible, report the exact mismatch and suggest the matching installed tool or a supported pack export; preserve the original pack. inspect and signed verification may be absent from older bundles; use their bundled documentation rather than swapping binaries. Use same-revision local references or pin main URLs below to the selected source commit/tag. Web links work outside the source checkout.

For an operator-supplied recorded pack (no target or credential needed):

: "${PACK:?set the existing evidence-pack directory}"
"$COH_BIN/coh" inspect --input "$PACK" --json

Inspect summary.json for captured, missing and errored entries before drawing conclusions. Keep mock/model, source declaration, target observation and signed proof labels. Do not fill a missing observation with a default or extrapolate beyond a bounded log’s retention.

If no pack exists, an explicitly labelled mock exercise creates local files:

ADOPTION_TMP=$(mktemp -d)
"$COH_BIN/coh" evidence pack --mock --out "$ADOPTION_TMP/mock-pack"
"$COH_BIN/coh" inspect --input "$ADOPTION_TMP/mock-pack" --json

Check the exporter exit status before proceeding. This creates a model pack, not target evidence. It does not run a GPU job. Retain the temporary path for review; delete only that newly created directory when it is no longer needed.

Capture an already-configured Queen

Obtain the expected target identity, existing gateway URL and scoped read credentials. For current non-public REST reads, the operator securely loads HIVE_GATEWAY_REQUEST_AUTH_TOKEN and COH_REST_TICKET with the necessary Read/ReadWrite paths and finite quota. Do not widen scope to complete a pack. Verify connection/profile first using host tools. The gateway remains the sole TCP console owner. Do not start another owner or reconfigure a live system to obtain a pack. Capture performs target reads and writes a bounded directory locally:

: "${COH_REST_URL:?set the existing gateway base URL}"
: "${PACK_OUT:?set a new private output directory}"
"$COH_BIN/coh" evidence pack --rest-url "$COH_REST_URL" --out "$PACK_OUT"

A nonzero exporter result can leave a useful partial summary.json. Preserve it and report the failed reads; do not overwrite it or label it complete. Missing optional paths and failed optional reads differ. Record capture time, tools, source/image/profile and target identity. Redaction is bounded: review before sharing and never attach private keys or secret-bearing configuration.

Derive a timeline or compare observations

Timeline generation writes timeline.ndjson, timeline.md, case.json and case.md inside its input directory. For a sealed/original pack, first copy it to a new private working directory and set PACK_WORK to that copy. Derived case summaries are explanations, not newly signed receipts.

: "${PACK_WORK:?set a writable working copy of the pack}"
"$COH_BIN/coh" evidence timeline --input "$PACK_WORK"

For two existing packs, this comparison is read-only:

: "${BEFORE_PACK:?set the earlier evidence directory}"
: "${AFTER_PACK:?set the later evidence directory}"
"$COH_BIN/coh" diff --left "$BEFORE_PACK" --right "$AFTER_PACK"

Identify differences in image/profile/authority as well as values. An unchanged capture is not a liveness proof. A partial pack can explain failure without establishing that an operation never ran. Host tools and operator recipes own the capture format.

Verify an operation’s signed outcome

A diagnostic pack is not itself a signed causal graph. Obtain the producer’s graph, retained CAS objects and independently enrolled public trust policy outside the pack. Do not trust keys merely because they arrived with evidence, create replacement signatures or weaken expected identity/time bindings.

: "${GRAPH:?set the producer graph JSON path}"
: "${TRUST:?set the independently enrolled trust policy path}"
: "${CAS:?set the retained content-addressed object directory}"
"$COH_BIN/coh" evidence verify --input "$GRAPH" --trust "$TRUST" --cas "$CAS"

Require exact subject/ticket/action/epoch, manifest/components, causal phases, artifact sizes/hashes and custody. Inspect terminal outcome: a verified failed or cancelled action is not the requested successful workload. Historical verification uses an explicit recorded time; it does not renew present authority. Missing/expired trust, corrupt CAS, mismatched binding or incomplete phases mean verification failure or unknown outcome. Preserve the error and route to the operator/custodian; do not rerun the workload to obtain a cleaner report.

Causal evidence explains gateway/native/Worker custody. A signed gateway observation can still have device_attested=false; native completion without the required Worker witness is not Worker proof. Return proven facts, remaining uncertainty, exact evidence references and safe next steps. Keep target acceptance, full release acceptance and newly measured performance distinct from these focused checks.