Evidence Bridge Core Concepts

Mapping profile

A mapping profile is an explicit, versioned set of rules that translates source JSON into the Bridge's internal evidence representation. Each rule identifies a source JSON pointer or constant, a destination evidence field, an optional deterministic transform and whether the value is required.

Published revisions are immutable. A change creates a new reviewed revision.

Deterministic transformation

same published profile
+ same supported mapping-engine version
+ same evidence target configuration
+ same source event
= same mapped meaning and integrity identities

The mapping runtime does not execute arbitrary customer code or perform network lookups.

Provenance

The Bridge records where each mapped field came from and which declared transform was used.

• values copied from the source
• constants declared by the profile
• values transformed by a deterministic rule

Evidence eligibility

A successful mapping does not automatically create evidence. The Bridge separately checks that the mapped event contains every semantic required by the selected evidence type. The interface reports mapping and eligibility as separate states.

Certificate hash

The certificate hash is the cryptographic identity of the created Certified Execution Record. It identifies the canonical evidence artifact, including its Protected (committed) and Readable field representations and protected provenance. It is not merely a hash of the original source JSON.

Local verification

The Bridge verifies created evidence locally. Before optional Node attestation, it loads and verifies the same persisted CER again. It does not reconstruct or reseal the record for retries.

Evidence disclosure

Protected or Readable determines the representation sealed into a Consequential CER. Protected fields carry an HMAC commitment; Readable fields carry the complete top-level value. Because it is part of CER construction, disclosure can affect the certificate hash.

Record visibility

Public or Private determines Node retrieval policy and is independent from the CER's disclosure choices. It does not change the CER, certificate hash or signatures.

Public  + Protected
Private + Protected
Public  + Readable
Private + Readable

No combination is more cryptographically valid than another. See Consequential Execution.

Auto-map

Auto-map is an authoring convenience based on approved source aliases. It:

• proposes reviewable mapping rules
• does not publish a profile
• does not create evidence by itself
• does not broaden the trusted mapping runtime
• leaves unknown OpenTelemetry attributes unmapped

Continue with Create a mapping profile.