Evidence & Provenance
Executive Summary
Key Takeaways
- ✓ Evidence and provenance are two distinct concerns in FMAE's data model — evidence justifies a specific finding, provenance identifies what engine and rule pack produced the audit as a whole.
- ✓ An evidence bundle is a deterministic export of facts already computed elsewhere in the pipeline — it performs no computation and infers nothing new at export time.
- ✓ Provenance includes the exact engine version and a cryptographic hash of the source file, so a specific audit run remains tied to a specific, verifiable input file.
- ✓ Where a finding's cell references intersect a detected circular dependency region, that region's full detail is included in the evidence bundle, not just a reference to it.
Two Distinct Concerns¶
FMAE's data model keeps two concerns separate that are easy to blur together in an audit report: evidence (the specific facts that justify one particular finding) and provenance (the record of what engine, rule pack, and source file produced the audit as a whole). A finding's evidence answers "why was this flagged"; provenance answers "what, exactly, produced this result, and is it the same result if run again against the same file."
What Provenance Records¶
Every parsed workbook carries a provenance record stamped once at parse time and extended as rule packs execute against it:
- Engine version — the exact version of the audit engine that parsed the file.
- Source file hash — a SHA-256 cryptographic hash of the source file, computed once during parsing, so a specific audit result can be verified against the exact file it was run against.
- Rule pack versions — which rule pack, at which version, has been executed against this manifest. The engine is the sole writer of this record: re-executing the same pack at the same version is a no-op, and recording two different versions of the same pack against the same manifest is treated as an error rather than silently overwritten (see Rule Engine & Rule Packs).
What an Evidence Bundle Contains¶
An evidence bundle is a deterministic export, built from an explicit selection of findings against a manifest, containing:
- The manifest's own provenance record, copied verbatim.
- The manifest's own coverage disclosure (see Coverage & Disclosure), copied verbatim.
- The explicit findings selected for the bundle, in the order given — never re-selected, re-ordered, or filtered by the export itself.
- Every circular dependency region already detected on the manifest whose member cells intersect any selected finding's cell references — included in full, not merely referenced, so a reader does not need to separately look up what a referenced circular region actually contains.
The bundle performs no computation and infers nothing: every field is copied from an object the platform had already computed at an earlier pipeline stage. This is a deliberate design choice — an evidence bundle that could subtly recompute or reinterpret a fact at export time would undermine the reproducibility the bundle exists to provide.
Why This Grounds Evidence-Based Findings¶
A finding is only as credible as the evidence and provenance behind it. Because every fact in an evidence bundle traces back to a specific engine version, a specific rule pack version, and a specific, hash-verified source file, an audit result can be checked, re-derived, and defended after the fact — not merely asserted.
Related Reading¶
- Finding Data Model & Confidence — what a finding itself contains, separate from the evidence bundle export described here.
- Coverage & Disclosure — the coverage disclosure carried inside every evidence bundle.
- Dependency Graph & Circularity Detection — how circular dependency regions, included in evidence bundles where relevant, are detected.
- Rule Engine & Rule Packs — how the rule pack provenance carried in every evidence bundle is recorded.
How OXXON tests thisRun a free structural check with FMAE
Frequently Asked Questions
What counts as audit evidence in FMAE?
The specific cell references, values or formula text, and a description tying a finding to exactly what triggered it — assembled into an evidence bundle alongside the audit's provenance, coverage disclosure, and any circular dependency regions the findings touch.
What is provenance, and why does it matter?
Provenance is the record of exactly what produced a given audit result — the engine version, a cryptographic hash of the source file, and which rule pack versions were executed against it. It is what lets a specific audit result be tied back to a specific, verifiable input and a specific version of the engine that produced it.
Does building an evidence bundle involve any additional analysis of the workbook?
No. An evidence bundle is a pure export of facts the platform has already computed at earlier pipeline stages — the manifest's own provenance and coverage, the given findings, and any circular dependency regions those findings' cell references land in. No new computation or inference happens at export time.
How is a source file's identity verified?
Provenance includes a SHA-256 cryptographic hash of the source file, computed once during parsing. This lets a specific audit result be verified against the exact file it was run against, rather than a file that merely has the same name.
Related Articles
FMAE Audit Engine — Architecture Overview
The FMAE audit engine processes a workbook through five stages executed in a fixed order — parsing and workbook ingestion, dependency graph construction, rule engine execution, risk scoring, and report generation. Each stage consumes the previous stage's output and exposes nothing about how any later stage will use it, so the stages can be documented, tested, and read about independently. This page is the map; the detail behind each stage lives on its own Technical Documentation page as those pages are published.
Finding Data Model & Confidence
Every FMAE finding carries the same fixed structure — which rule triggered it and that rule's identity at the time it ran, its evidence, a narrative explanation, and a confidence label of high, medium, or low. Confidence is a deterministic categorical label derived from how strongly a row's cells agree on a pattern, not a machine-learning probability estimate. Stating this plainly matters, since describing FMAE's confidence as AI-derived or probabilistic would overstate what the engine actually does.
Coverage & Disclosure
Every FMAE audit carries a coverage disclosure — a machine-readable statement of what kinds of references the engine's reference resolver did and did not resolve into graph edges for that parse. Rather than silently assuming full coverage of a workbook's reference graph, FMAE states plainly what it resolved (single-cell references) and what, in this version of the platform, it does not (structured table references, most dynamic references), and counts how many instances of each were present. This is a transparency mechanism, not a marketing claim, and is a genuine limitation stated honestly rather than omitted.