Trust Model

Provenance

What was measured, exactly.

Provenance is a structured fingerprint of how a run was produced, recorded across ten dimensions — framework, metric spec, evaluator, dataset, example, evidence, config, policy, authority, and baseline. It is what gives a later comparison something concrete to check before it claims anything.

A score without provenance is not interpretable: you cannot tell whether two runs differ because the model changed or because the metric, dataset, or config did. EvalGlass hashes each dimension — a SHA-256 of its canonical JSON — so “what produced this number” is recorded, not remembered.

The ten dimensions

Each dimension is fingerprinted independently. Six are gating: they must match for two runs to support a regression claim. The other four are recorded for inspection but do not block a comparison.

DimensionCapturesGating?
frameworkThe EvalGlass version that ran.Yes
metric_specThe metric’s declared meaning.Yes
evaluatorThe evaluator reference and version.Yes
datasetThe dataset identity, status, and version.Yes
configThe runtime configuration.Yes
policyThe data policy in force.Yes
exampleThe specific example measured.No — different examples still compare.
evidenceThe evidence inputs collected.No
authorityThe authority inputs at run time.No
baselineThe baseline reference, if any.No
Fail-closed by construction Comparison treats an absent dimension as changed, not as a match, and fingerprint_dimension raises on a value that is not JSON-serializable rather than guessing. A fingerprint can therefore only ever under-claim comparability, never over-claim it.

The full fingerprint and the per-dimension hashes are written into the RunRecord, so any later run — or a reviewer — can recompute and check them.

Next steps