# Private evidence registry template

Copy this template only into the dedicated private studio registry. The packaged template
includes the standalone `scripts/validate-evidence-registry.mjs` gate. When working from a
source checkout, copy that file from the repository's `scripts/` directory. Pin review
ownership for both the validator and the workflow. The plugin repository does not activate
this workflow.

Outcome records belong under `evidence/outcomes/YYYY/MM/<event-id>.json`. Do not add raw
project evidence, client identifiers, prompts, messages, transcripts, credentials, or
local paths to this repository.

Every ingest batch also requires one canonical
`evidence/attestations/<batch-sha256>.json` record. The dedicated registry bot signs the
sorted outcome path/hash inventory with a registry-only HMAC key. Configure that key as
the base64 GitHub Actions secret `HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY` and configure
its non-secret identifier as the repository variable
`HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY_ID`. Use at least 32 random key bytes. This key
must be different from every project, receipt, or outcome authentication key and must
never be committed to either repository.

The template intentionally ships no trust root. Validation fails closed when the secret,
key identifier, a batch attestation, or exact one-to-one outcome coverage is missing.
Pull requests from contexts that cannot access the registry-bot secret therefore cannot
pass the provenance gate; the trusted bot must attest the batch in a secret-bearing CI
context.

For pull requests, the workflow runs the validator from the trusted base revision and
checks the candidate checkout as inert data. It never executes the candidate's validator
or other repository code with the HMAC secret. Keep the workflow and validator under
required CODEOWNERS review and branch protection.