Release Evidence Kit

Combine submitted checks, artifact integrity metadata, limitations, rollback notes, and evidence references into one deterministic release packet.

Release owners who need a safe machine packet and human handoff without executing or certifying a release.

Release evidence request JSON

{
  "release": {
    "id": "utilito-web",
    "version": "1.2.3",
    "channel": "production",
    "submitted_at": "2026-07-19T00:00:00Z"
  },
  "checks": [
    {
      "id": "unit",
      "domain": "tests",
      "status": "pass",
      "severity": "required",
      "summary": "Unit suite passed",
      "evidence_refs": [
        "test-log"
      ],
      "artifact_refs": [
        "web-bundle"
      ]
    },
    {
      "id": "contracts",
      "domain": "contracts",
      "status": "pass",
      "severity": "required",
      "summary": "Contract suite passed",
      "evidence_refs": [
        "contract-log"
      ],
      "artifact_refs": []
    }
  ],
  "artifact_manifests": [
    {
      "ref": "web-bundle",
      "path": "dist/app.js",
      "bytes": 123,
      "algorithm": "sha256",
      "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
    }
  ],
  "known_limitations": [
    "All check statuses and digests are caller-submitted and remain unverified."
  ],
  "rollback_notes": [
    "Restore the previously approved artifact manually after independent review."
  ],
  "evidence_references": [
    {
      "id": "test-log",
      "kind": "test-log",
      "ref": "ci://run/1",
      "summary": "Caller-submitted test output"
    },
    {
      "id": "contract-log",
      "kind": "contract-report",
      "ref": "file://contract.json",
      "summary": "Caller-submitted contract output"
    }
  ],
  "policy": {
    "required_domains": [
      "tests",
      "contracts"
    ],
    "required_check_ids": [
      "unit",
      "contracts"
    ],
    "report_format": "markdown"
  }
}

Statuses and digests remain caller-submitted and unverified. This kit cannot release, sign, deploy, or certify anything.

The visible sample was generated during this static build. Regenerate current input to enable copy and downloads.

Release decision matrix

{
  "schema_version": "utilito.release-matrix.v1",
  "decision": "pass",
  "rows": [
    {
      "artifact_refs": [],
      "domain": "contracts",
      "evidence_refs": [
        "contract-log"
      ],
      "id": "contracts",
      "severity": "required",
      "status": "pass",
      "summary": "Contract suite passed",
      "submitted_unverified": true
    },
    {
      "artifact_refs": [
        "web-bundle"
      ],
      "domain": "tests",
      "evidence_refs": [
        "test-log"
      ],
      "id": "unit",
      "severity": "required",
      "status": "pass",
      "summary": "Unit suite passed",
      "submitted_unverified": true
    }
  ],
  "summary": {
    "pass": 2,
    "block": 0,
    "unknown": 0,
    "required": 2
  },
  "submitted_statuses_unverified": true
}

Complete release evidence envelope

{
  "ok": true,
  "schema_version": "utilito.product-kit.v1",
  "kit": {
    "id": "release-evidence-kit",
    "version": "1.0.0"
  },
  "result": {
    "decision": "pass",
    "status": "review_ready",
    "release_matrix": {
      "schema_version": "utilito.release-matrix.v1",
      "decision": "pass",
      "rows": [
        {
          "artifact_refs": [],
          "domain": "contracts",
          "evidence_refs": [
            "contract-log"
          ],
          "id": "contracts",
          "severity": "required",
          "status": "pass",
          "summary": "Contract suite passed",
          "submitted_unverified": true
        },
        {
          "artifact_refs": [
            "web-bundle"
          ],
          "domain": "tests",
          "evidence_refs": [
            "test-log"
          ],
          "id": "unit",
          "severity": "required",
          "status": "pass",
          "summary": "Unit suite passed",
          "submitted_unverified": true
        }
      ],
      "summary": {
        "pass": 2,
        "block": 0,
        "unknown": 0,
        "required": 2
      },
      "submitted_statuses_unverified": true
    },
    "integrity_table": {
      "schema_version": "utilito.artifact-integrity.v1",
      "artifacts": [
        {
          "algorithm": "sha256",
          "bytes": 123,
          "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
          "path": "dist/app.js",
          "ref": "web-bundle",
          "caller_submitted": true,
          "recomputed": false,
          "provenance_proven": false
        }
      ],
      "claims": {
        "integrity_metadata_recorded": true,
        "digests_recomputed": false,
        "provenance": false,
        "signature": false,
        "reproducibility": false,
        "deployment_match": false
      }
    },
    "machine_packet": {
      "schema_version": "utilito.release-packet.v1",
      "release": {
        "channel": "production",
        "id": "utilito-web",
        "submitted_at": "2026-07-19T00:00:00Z",
        "version": "1.2.3"
      },
      "decision": "pass",
      "release_matrix": {
        "schema_version": "utilito.release-matrix.v1",
        "decision": "pass",
        "rows": [
          {
            "artifact_refs": [],
            "domain": "contracts",
            "evidence_refs": [
              "contract-log"
            ],
            "id": "contracts",
            "severity": "required",
            "status": "pass",
            "summary": "Contract suite passed",
            "submitted_unverified": true
          },
          {
            "artifact_refs": [
              "web-bundle"
            ],
            "domain": "tests",
            "evidence_refs": [
              "test-log"
            ],
            "id": "unit",
            "severity": "required",
            "status": "pass",
            "summary": "Unit suite passed",
            "submitted_unverified": true
          }
        ],
        "summary": {
          "pass": 2,
          "block": 0,
          "unknown": 0,
          "required": 2
        },
        "submitted_statuses_unverified": true
      },
      "integrity_table": {
        "schema_version": "utilito.artifact-integrity.v1",
        "artifacts": [
          {
            "algorithm": "sha256",
            "bytes": 123,
            "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "path": "dist/app.js",
            "ref": "web-bundle",
            "caller_submitted": true,
            "recomputed": false,
            "provenance_proven": false
          }
        ],
        "claims": {
          "integrity_metadata_recorded": true,
          "digests_recomputed": false,
          "provenance": false,
          "signature": false,
          "reproducibility": false,
          "deployment_match": false
        }
      },
      "evidence_references": [
        {
          "id": "contract-log",
          "kind": "contract-report",
          "ref": "file://contract.json",
          "summary": "Caller-submitted contract output"
        },
        {
          "id": "test-log",
          "kind": "test-log",
          "ref": "ci://run/1",
          "summary": "Caller-submitted test output"
        }
      ],
      "known_limitations": [
        "All check statuses and digests are caller-submitted and remain unverified."
      ],
      "rollback_notes": [
        "Restore the previously approved artifact manually after independent review."
      ],
      "safety": {
        "deterministic": true,
        "model_used": false,
        "network_used": false,
        "storage_used": false,
        "telemetry_used": false,
        "write_back": false,
        "release_execution": false,
        "signing": false,
        "deployment": false,
        "certification": false
      }
    },
    "release_report": {
      "format": "markdown",
      "mime_type": "text/markdown",
      "content": "# Release evidence report\n\nDecision: **pass**\n\nAll statuses and digests are caller-submitted and unverified. Integrity metadata is not provenance, signing, certification, reproducibility, or deployment evidence.\n\n| Domain | Check | Status | Summary |\n|---|---|---|---|\n| contracts | contracts | pass | Contract suite passed |\n| tests | unit | pass | Unit suite passed |\n\n## Known limitations\n\n- All check statuses and digests are caller\\-submitted and remain unverified\\.\n\n## Rollback notes\n\n- Restore the previously approved artifact manually after independent review\\.\n"
    },
    "handoff_record": {
      "schema_version": "utilito.release-handoff.v1",
      "release": {
        "channel": "production",
        "id": "utilito-web",
        "submitted_at": "2026-07-19T00:00:00Z",
        "version": "1.2.3"
      },
      "decision": "pass",
      "blockers": [],
      "unknowns": [],
      "artifacts": [
        "web-bundle"
      ],
      "evidence": [
        "contract-log",
        "test-log"
      ],
      "rollback_notes": [
        "Restore the previously approved artifact manually after independent review."
      ],
      "next_actions": [
        "Independently verify caller-submitted checks and digests before release."
      ],
      "submitted_statuses_unverified": true,
      "release_executed": false
    },
    "limitations_receipt": {
      "schema_version": "utilito.release-limitations-receipt.v1",
      "known_limitations": [
        "All check statuses and digests are caller-submitted and remain unverified."
      ],
      "rollback_notes_present": true,
      "integrity_evidence_scope": "caller_submitted_shape_validated_not_recomputed",
      "no_provenance_claim": true,
      "no_certification_claim": true
    },
    "artifact_manifest": [
      {
        "name": "release_matrix",
        "media_type": "application/json",
        "bytes": 792
      },
      {
        "name": "integrity_table",
        "media_type": "application/json",
        "bytes": 572
      },
      {
        "name": "machine_packet",
        "media_type": "application/json",
        "bytes": 2580
      },
      {
        "name": "release_report",
        "media_type": "text/markdown",
        "bytes": 571
      },
      {
        "name": "handoff_record",
        "media_type": "application/json",
        "bytes": 629
      },
      {
        "name": "limitations_receipt",
        "media_type": "application/json",
        "bytes": 355
      }
    ],
    "safety": {
      "deterministic": true,
      "model_used": false,
      "network_used": false,
      "storage_used": false,
      "telemetry_used": false,
      "write_back": false,
      "release_execution": false,
      "signing": false,
      "deployment": false,
      "certification": false
    }
  },
  "receipt": {
    "input_bytes": 1177,
    "output_bytes": 5714,
    "operations": 5,
    "omitted_items": 0,
    "warnings": [],
    "checks": 2,
    "artifacts": 6,
    "evidence": 2,
    "matrix_rows": 2
  },
  "provenance": {
    "deterministic": true,
    "model_used": false,
    "network_used": false,
    "storage_used": false,
    "core_versions": {
      "release_evidence_kit": "1.0.0",
      "file_integrity_manifest": "submitted-digest-shape-v1",
      "evidence_report": "safe-render-v1",
      "handoff_record": "release-handoff-v1"
    }
  },
  "error": null
}

Download matrix Download integrity Download packet Download report Download handoff Download limitations

Free runnable capability

Build and download one bounded browser-local release evidence packet with no signup.

Builder capability

The existing Builder Pilot can coordinate higher bounded review volume; it does not add verification, release execution, signing, deployment, certification, storage, or monitoring.

See the existing Builder Pilot

Privacy boundary

Browser generation runs locally. API and MCP are response-only; no model, network, storage, telemetry, repository write, release execution, signing, deployment, or certification occurs.

Evidence limits

Check statuses are preserved as caller-submitted and unverified. Missing, unknown, or unsupported required checks stay unknown; required blockers always block. Prose cannot override either decision.
Digest syntax, algorithm length, byte count, reference uniqueness, and safe relative paths are validated. Digests are not recomputed and do not prove provenance, signatures, reproducibility, certification, or deployment match.
The browser rejects normal non-plain values and catches access failures, but JavaScript cannot reliably identify every transparent Proxy without a host-specific detector. No release, repository, signing, deployment, or certification action is available.