checkId: check.compliance.evidence-integrity plugin: stellaops.doctor.compliance severity: fail tags: [compliance, security, integrity, signatures]

Evidence Integrity

Source status (2026-10-07): this Doctor probe has no supported Evidence endpoint. The current host is evidence-web; its native prefix is /api/evidence/v1. Adding that prefix to the probe suffix does not make the missing handler available.

What the check does

EvidenceTamperCheck.cs still reads EvidenceLocker:Url or Services:EvidenceLocker:Url. Without either key, the check is not applicable. With a key, it issues an HTTP request with a 60-second timeout. A non-success HTTP status returns Warn, including the status and configured origin; this result does not verify the underlying control.

Historical defect observation (2026-10-07): the implementation’s request target remains GET /api/v1/evidence/integrity-check. That retired target is recorded here to identify the Doctor integration defect, rather than as an operator endpoint.

The owning source has no integrity-check handler at the consolidated prefix. Do not interpret a missing route as failed evidence integrity, an audit verdict, an export capability measurement, or an evidence generation rate. Retargeting configuration alone cannot repair this check. The Doctor owner must establish a supported Evidence contract and update the probe before this check supplies that measurement.

Operator verification

  1. Run stella doctor --check check.compliance.evidence-integrity.
  2. Preserve the result, configured origin, HTTP status, and observation time.
  3. Compare the deployed Evidence build with the owning source before investigating the missing handler.
  4. Use supported bundle, capsule, and export operations from the Evidence architecture for the specific evidence task.

The consolidated host maps anonymous GET /health/ready; it suppresses the carried health endpoints. This readiness result reports host composition. Host health does not replace this check’s missing compliance measurement.

Re-verification

Verified against source commit 6e96dcf6dc0c8a03446aba2ead01fa2f6d47366c on 2026-10-07: src/Doctor/__Plugins/StellaOps.Doctor.Plugin.Compliance/Checks/EvidenceTamperCheck.cs and src/Evidence/StellaOps.Evidence.WebService/Program.cs, with its mapped application handlers. Re-verify the probe request and warning branch, then enumerate the owning host’s endpoint mappings. No runtime probe or compliance acceptance was performed for this documentation correction.