Assurance · Understanding evidence

What does the evidence establish?

Five categories of requirements distinguish file integrity, event sequence, input signals, environment and hardware trust. A record supports only the claims established by its specific checks. humanproof/1 uses the localObservation profile.

Requested does not mean achieved.

Only satisfied and verified requirements determine the achieved level. An observation gap can lower it; choosing a higher level cannot replace missing evidence.

The synthetic record contains an observation gap. It demonstrates verification of the current assurance format; synthetic data does not establish a real process and does not receive L2 here.

Current example: L2 requested, L1 achieved

Evidence-based verification profilesMore context. Explicit limitations.

L1
Document Integrity
The record is unchanged and belongs to exactly this file version.
Relevant for pilot workflows
Hash · signature
L2
Process Provenance
A complete session with an observed event history and no critical observation gap.
Relevant for pilot workflows
Process history
L3
Physical Input Verified
Physical input is correlated with changes in the writing tool.
Pilot-relevant, depends on the writing environment
Input signals
L4
Sealed Environment
A controlled system environment with continuously verified safeguards.
Model extension · not part of the pilot
Environment profile
L5
Hardware Attested
Independent hardware attestation.
Model extension · requires separate hardware
Device trust

Higher assurance means more technical properties were verified. It does not mean a higher “probability of being human”.

A record states only the properties supported by evidence. There is no automatic upgrade. The profiles describe evidence categories, not an independent certification standard. A higher profile does not guarantee the absence of AI assistance. Understand verification scope and trust boundaries.

ExtraProof for macOS: overview of a synthetic sample session about everyday learning. — Session overview · ExtraProof 1.9.0

Scope and limits per level

L1 Document Integrity

Document binding, a complete hash chain and a valid signature establish record integrity.

Limitation: Matching the actual file remains a separate check. L1 does not establish a writing process.

L2 Process Provenance

In addition to L1: a complete session with temporal history, observed events, chain checkpoints and no critical observation gap.

Limitation: Local recorder claims do not establish human authorship or the truth of all input data.

L3 Physical Input Verified

In addition to L2: a verified physical input path, operating-system and document correlation, and continuous classification of unverified inputs.

Limitation: L3 is limited to the strictly correlated input path of supported native writing applications. Integrations with other writing apps do not currently meet this profile.

L4 Sealed Environment

In addition to L3: actively enforced environment rules and evidenced compliance throughout the session.

Limitation: sealedObservation only observes and does not satisfy L4. L4 is currently unavailable.

L5 Hardware Attested

In addition to L4: independently verified hardware attestation from an appropriate trust chain.

Limitation: Secure Enclave, TPM and hardware-protected keys alone are insufficient. L5 is reserved and currently unavailable.

File version and event sequence.

L1 describes the integrity of a bound file version. L2 describes a verifiable sequence of recorded events. File binding and the event chain answer different questions: identical bytes do not automatically establish that the session produced those bytes.

Input signals in context.

L3 describes the temporal relationship between input signals and observed activity. Permissions and capture methods determine what is visible. Even physically typed text can be based on someone else’s source material.

Environment and hardware.

L4 requires evidenced controls over a defined environment. L5 also requires validated hardware attestation. Observed processes or a protected key are insufficient on their own. Each additional claim needs its own evidence and a verifiable basis for trust.

A profile, not a blanket seal of approval.

humanproof/1 confirms local recorder claims and does not automatically grant L1–L5 certification. Verification presents integrity, key trust and file comparison separately. The five categories help define precise requirements; they are not a score for freedom from AI assistance.

Requested and achieved are separate findings.

A record may only state the level actually achieved. A higher request cannot replace missing evidence. The verifier recomputes the requirements and reports discrepancies.

Technical limitations in detail

What does the evidence establish?

Requested does not mean achieved.

Document Integrity

Process Provenance

Physical Input Verified

Sealed Environment

Hardware Attested

File version and event sequence.

Input signals in context.

Environment and hardware.

A profile, not a blanket seal of approval.

Requested and achieved are separate findings.

Extraara is a member of the Content Authenticity Initiative.