Evidence

Verified against commit 942a18727c on 2026-09-26 (UTC). Re-verify: grep -nE "^ (evidence-web|evidence-worker|attestor-tileproxy|tsa):" devops/release/bundle/docker-compose.yml and ls src/Evidence src/Evidence/__Libraries src/EvidenceLocker/__Libraries.

Service rows (host project, image, database and role, compose file, bundle presence, Doctor registration) are generated in docs/architecture/service-inventory.md; where this page and the inventory differ, the inventory is authoritative.

The consolidated evidence and attestation service (ADR-039 D14): sign-off evidence is attested, anchored in a local transparency log, sealed into capsules and bundles, time-stamped, held and exported from one family with one database. Signer is not part of this family.

Start here: architecture.md.

Deployables

attestor-tileproxy and tsa are family members by ownership, not by compose key: the tile proxy is its own small ASP.NET host, tsa is an openssl container, and neither has a database.

Database

• One database, stellaops_evidence, on the shared PostgreSQL server, with its own role.
• Connection: STELLAOPS_POSTGRES_EVIDENCE_CONNECTION (or Postgres:Evidence:ConnectionString); the DAL refuses to start without it and has no shared-connection fallback (src/Evidence/__Libraries/StellaOps.Evidence.Persistence/Extensions/ConsolidatedEvidencePersistenceExtensions.cs).
• Migrations: embedded SQL in src/Evidence/__Libraries/StellaOps.Evidence.Persistence/Migrations/, applied at startup by both roles through AddStartupMigrations into the evidence.schema_migrations ledger. Schemas: evidence, attestor, proofchain, evidence_locker, evidence_locker_app.

API surface

The canonical prefix is /api/evidence/v1, plus absolute controller routes under /api/v1, /anchors, /proofs and /verify. The published route set is pinned in src/Evidence/__Tests/StellaOps.Evidence.WebService.Tests/Fixtures/consolidated-route-inventory.tsv.

All libraries above are under src/Evidence/__Libraries/. Shared contract, export, import and timestamping libraries remain under src/EvidenceLocker/__Libraries/, and the encrypted-backup tool is src/EvidenceLocker/__Apps/StellaOps.EvidenceLocker.BackupCli/.

Doctor checks

evidence-web serves GET /doctor/evidence/checks behind ops.health: the family checks (doctor.evidence.database.*, doctor.evidence.data-integrity.*, doctor.evidence.retention.*), the SDK standard checks and the Timestamp Assurance checks (doctor.evidence.timestamp.*). The full list is in architecture §7.

Retention

Retention classes, cleanup budgets and custody boundaries: retention-classification.md. RFC-15 Q-38 added migration 011_evidence_counsel_retention_reclamation.sql and the counsel-retention reclamation worker (architecture §2).

Retired predecessors

Operating

• Compose definition: devops/compose/docker-compose.evidence.yml, with reviewed immutable digests in devops/compose/docker-compose.local-evidence.yml.
• Cutover and isolated-rehearsal runbook: ../../runbooks/evidence/evidence-evd9-data-move.md.
• Operator runbooks: ../../runbooks/evidence/.

Subordinate documents