What a decision report is

A decision report answers one question about one thing: measured against the standard we require, does this pass? It is built from signed evidence, and it says exactly which evidence it used.

• A target. What is being assessed: a repository, or a product defined as the set of repositories a contract covers.
• Signed evidence. A measurement produced elsewhere and cryptographically signed. Assay fetches it; it does not create it.
• A bar. The standard the buyer requires, at a specific published version. How a bar decides covers this.

A verdict against the bar, the scores the evidence carried, and the reasoning that connects them: rendered both as structured data and as a document a person can read. Every report names the exact evidence it was built from, so the claim can be traced back to a specific measurement of a specific commit.

Two rules constrain it, and both are absolute.

Scores are never recomputed. The numbers in a report are echoed verbatim from the signed evidence. Nothing in Assay calculates, adjusts, or overrides a score. Verification re-derives the verdict in order to check it: never to change it.

Unverifiable evidence is refused. A report is only built when the signature is authentic and the verdict reproduces. Evidence that fails either test does not produce a cautious report or a lower score: it produces no report, and the request is recorded as failed.

The reason for both is the same: a buyer's report has to be worth something to a third party. A number we adjusted, or evidence we accepted on trust, would make the report an opinion about a supplier rather than a verifiable statement.

Buyers rarely buy one repository. A product is the set of repositories a contract attests to, and a product-level report is built by producing one report per member and rolling those up. The roll-up shows which members cleared, which were rejected, and which had no usable evidence: the three are reported separately, because "we could not get evidence" and "it failed" are different facts for a buyer.

The rendered artifact is frozen at the moment it is built and stored as delivered. Later changes to a bar, to the supplier's code, or to the system itself do not alter an existing report. A report read today is byte-for-byte the report that was served when it was issued.