# 10 · RunProof — Portable Evidence

> Hash-linked events, verifiable offline.

## Overview

Execution without evidence is indistinguishable from fiction. RunProof is
Arcana's canonical evidence layer: it records what was requested, which
policies and capabilities were evaluated, what executed, which evidence was
produced, how completion was verified, whether the event chain is intact, and
whether the result is reproducible.

## Integrity: the hash chain

```text
eventHash_i = H(canonical(event_i) ∥ eventHash_(i-1))
runRoot     = H(runMetadata ∥ terminalEventHash ∥ proofSchemaVersion)
```

Every event commits to its predecessor; the runRoot commits to the final
state. Flip one byte anywhere in history and every subsequent hash — and the
root — breaks. The chain plus sequence uniqueness plus transactional insertion
removes ambiguous ordering.

## Replay modes

| Mode | Goal |
|---|---|
| Audit replay | Reconstruct historical events and decisions without re-executing effects |
| Deterministic replay | Rebuild structured commands, exact output digests, workspace mutations, and policy decisions under controlled fixtures |
| Live revalidation | Evaluate whether historical evidence still satisfies current policy — without rewriting historical truth |

## Security profiles

Four profiles ride alongside the event chain:

| Profile | Tracks |
|---|---|
| AuthorizationProfile | requests, allowed, denied, approvalsRequired, staleDecisions, executed, failures, unauthorizedExecutions, capabilityViolations, trace health |
| InformationFlowProfile | labeled inputs, derived values, secret use, denied secret flows, declassification requests, tampering attempts, unlabeled consequential requests |
| DelegationProfile | requested, created, denied, maximum depth, invalidated descendants, authority amplifications, trace health |
| ApprovalProfile | requested, approved, rejected, expired, claimed, consumed, replay attempts, hash mismatches, recovery required, trace health |

## Trace health

Evidence quality is itself reported: **COMPLETE**, **DEGRADED**, or
**UNAVAILABLE**. A profile claiming zero violations means nothing unless its
trace is COMPLETE — absence of evidence is not evidence of absence.

## Portability

Proofs export to JSON and verify offline — no access to the original machine
required. Anyone with the export can recompute the chain, check the root, and
re-run the verifier.

## Related

- Previous: [Signed Envelopes](/governance/envelopes.md)
- Next: [Assurance Formulas & Boundaries](/governance/assurance.md)