Chapter 48 — Evidence dossier
Lesson map
Lesson 48 published. Map, example, EX142.
flowchart TD
N0["Learning outcomes"]
N1["48.1 What the dossier is"]
N2["48.2 Structure"]
N3["48.3 Integrity and reproducibility"]
N4["48.4 Honest residual risk"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX142"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["48.1 What the dossier is"]
N2["48.2 Structure"]
N3["48.3 Integrity and reproducibility"]
N4["48.4 Honest residual risk"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX142"]
[Learning outcomes]
|
v
[48.1 What the dossier is]
|
v
[48.2 Structure]
|
v
[48.3 Integrity and reproducibility]
|
v
[48.4 Honest residual risk]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX142]
Learning outcomes
You will (1) assemble an evidence dossier that supports a safety-and-security case for the capstone; (2) organise evidence by claim and requirement; (3) ensure evidence integrity and reproducibility; and (4) state residual risk and limitations honestly.
48.1 What the dossier is
The dossier is the complete, organised body of evidence that the system meets its requirements and that its residual risks are understood and accepted. It supports the safety-and-security case and is what an assessor, client or regulator would examine.
The dossier is assembled throughout the project, not at the end. Each test report, review and trial result is filed with its versions as it is produced, so the final task is organising and linking rather than searching. An assessor should be able to start from any claim and reach the evidence for it in a few steps, and start from any piece of evidence and see which claim it supports.
48.2 Structure
- Summary: system, intended use, claims, residual risks, recommendation.
- Safety-and-security case: claims, arguments, evidence references, defeaters.
- Requirements traceability matrix: requirement → design → implementation → verification result.
- Verification and validation reports (Labs I–II, red team, pilot).
- Recovery-trial report and after-action actions.
- Design reviews and their closure.
- Configuration: versions and hashes of code, models, data, prompts.
- Documentation: model cards, datasheets, runbooks.
- Residual-risk register with owners and review dates.
The order follows an assessor's questions. The summary answers what is claimed, the case why it should be believed, and the matrix where to check.
48.3 Integrity and reproducibility
Record hashes of evidence files in a manifest; store the dossier in a version-controlled repository; make evaluation reproducible from recorded configurations (scripts, seeds, environments). The hash lab from Chapter 19 is the simplest form of this discipline.
"""Lab H: integrity of model artefacts with SHA-256 manifests (stdlib only).
Creates synthetic 'artefact' bytes, records a manifest, then detects a
one-byte tampering and a swapped file. No real models are involved."""
import hashlib, json
files = {"model.bin": bytes(range(256)) * 40, "tokenizer.json": b'{"vocab": ["a", "b"]}',
"config.yaml": b"layers: 4\nheads: 8\n"}
manifest = {n: hashlib.sha256(b).hexdigest() for n, b in files.items()}
print(json.dumps({k: v[:16] for k, v in manifest.items()}, indent=1))
received = dict(files)
tampered = bytearray(received["model.bin"]); tampered[5000] ^= 1
received["model.bin"] = bytes(tampered)
received["config.yaml"] = b"layers: 4\nheads: 8\ntrust_remote_code: true\n"
for n, b in sorted(received.items()):
ok = hashlib.sha256(b).hexdigest() == manifest[n]
print(f"{n:15s} {'OK' if ok else 'MISMATCH'}")
Expected output:
{
"model.bin": "e96760a87768717b",
"tokenizer.json": "f63d2ddabc61f2d9",
"config.yaml": "e5bbb570ca0fcb87"
}
config.yaml MISMATCH
model.bin MISMATCH
tokenizer.json OK
A manifest shows that evidence was not changed after it was produced; reproducibility shows that it can be produced again. Recording seeds, environments and versions makes reruns possible years later, for example when a regulator asks about a past release. Version control adds a history of when each piece of evidence was added and by whom, which helps an assessor understand how the dossier grew.
48.4 Honest residual risk
List what was not tested, what failed and was accepted, and what depends on assumptions (for example, "technicians read approval screens"). Regulators and clients trust dossiers that state limits.
Assumptions deserve particular care because they are invisible until they fail. Bulletin Gate assumes supplier bulletins arrive through an authenticated channel; if that assumption breaks, an attacker could send bulletins directly. Writing the assumption down, with what would show it no longer holds, turns it into something the operators can monitor. A residual-risk entry also names who accepted the risk and when it will be reviewed.
48.5 Worked example (synthetic NRS case)
Sam's Bulletin Gate dossier had 41 requirements, 39 passed, one passed after a fix and re-test, and one (image attachments) was formally out of scope. Residual risks included adaptive attacks beyond the tested set, dependence on supplier channel authentication and reviewer attention. The evidence manifest listed 312 files with SHA-256 hashes; an assessor reran the evaluation harness from the dossier and reproduced the headline numbers within their intervals.
The reproduction by the assessor is the dossier's strongest evidence, since it shows the results came from the recorded system and not from an unrepeatable run.
48.6 Errors and limits
- Dossiers that collect documents without linking them to claims.
- Missing versions and hashes.
- Residual-risk sections that say "none".
A folder of documents without links to claims leaves the assessor to build the argument, and they may build a different one. Missing versions mean nobody can tell which system a result describes. A residual-risk register that says 'none' is never true and suggests the team did not look. Sam's dossier template refuses to build if any claim has no evidence link or any evidence file has no hash.
Exercises
- EX142 — Structure. List the nine dossier sections. Rubric: 3 = nine; 2 = seven; 1 = four; 0 = fewer.
- EX143 — Traceability matrix. Write one row of the traceability matrix for Bulletin Gate. Rubric: 3 = requirement, design element, implementation, test, result; 2 = four; 1 = two; 0 = none.
- EX144 — Residual risk. Write two residual-risk entries with owners and review dates. Rubric: 3 = specific, owned, dated; 2 = one complete; 1 = vague; 0 = none.
Synthesis
The evidence dossier makes the capstone assessable: claims linked to verified, versioned, reproducible evidence and an honest register of what remains.
Continue studying — chapter 48 of 50
← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →