---
title: "Evidence, not declaration"
summary: "The principle that separates what you declared from what is observed, and how it shapes approval, tiers, drift, and structured output."
description: "Why a field in a file is never allowed to assert that something is true on the host."
status: shipped
read_when:
  - "Understanding why an approval is separate from a plan"
  - "Understanding why declaring protection would not establish it"
  - "Designing something that has to report status accurately"
---
A configuration file records what you want, not what is true on the host;
`backup: true` is only a line in a file. Onebox keeps the two apart.

## Approval is not model intent

> A statement that the user approved is data, not authority.

The current CLI requires a local human ceremony bound to the exact
sealed plan, operator label, server, observed state, inputs, risk, and expiry.
`ob plan` and `ob approve` are separate commands so the reviewed object and the
answer cannot drift unnoticed. The resulting `local_cli` artifact is
tamper-evident, but it is not authenticated identity or an independently issued
capability: an actor with access to the same local runner can create it.

That limitation is part of the contract. A future external approval provider
would need its own trust root, enrollment, revocation, and recovery design;
Onebox does not pretend a local checksum creates that boundary.

Secrets follow the same rule: they enter through a trusted local or encrypted
flow, never through ordinary model-visible arguments.

## Declaration is not protection

Backup applies the principle to data recovery. A service reports `Managed` only
while, **all at once**:

- the recorded immutable image digest is effective
- resource policy is effective
- driver health verifies through its qualified probe
- the declared protection objective is currently satisfied
- the backup schedule is installed
- the latest recoverable point is within policy
- replay continuity passes where applicable
- restore-drill proof is fresh

Any one of those expiring returns the service to `Run` immediately. Historical
proof stays visible but cannot be mistaken for current protection.

Trusting the policy block alone would report a protected service even if its
backups had been failing for a month.

> **Tier and envelope are separate**
>
> `Managed` would always be accompanied by the recovery kind (`snapshot`, `pitr`
> or `cold`) plus the observed recovery point and measured restore time. Otherwise
> "managed Redis" reads as point-in-time recovery it does not have.

## Observation cannot mutate

Read commands do not repair, converge, prune or create. `ob status` and
`ob doctor` read evidence; they never trigger the check that produces it.

In the proposed assurance layer, the check process has no converge methods
in its operation graph.

## Origins are published

See [origin annotations](/docs/get-started/reading-it-back#ob-canonical-is-the-one-to-read-in-review)
for `ob canonical`, including `# default`, `# shorthand`, `# override` and defaults
such as `retainReleases: 5`. Structured output labels authored, default,
environment-override, observed and derived values.

## Checkout provenance

The journal's `git_sha` and the audit table's `GIT` column show the checkout's
short HEAD revision. Modified, staged, deleted, or untracked files add `+dirty`;
release directory IDs use `-dirty` to keep their existing safe format. If Git
cannot read either the revision or the working-tree state, the field is omitted.

This describes the checkout when inspected. Git-ignored files are excluded, and
the revision does not prove which bytes were shipped. The sealed plan's payload
digest binds the staged release contents separately.

## Drift fails closed

A server-side artifact that differs from what the plan bound is a typed drift
error **before** mutation, not a silent reconciliation. The plan expires after
fifteen minutes for the same reason: an approval bound to observed state is
worthless once that state may have moved.

## What this costs

Observed evidence can produce worse-looking status pages. A service that oscillates
between `Managed` and `Run` because a drill keeps being deferred for disk space
looks broken, where a tool that trusted the declaration would look fine.