Using the product

Evidence screens

Evidence, Trust Ledger, Time Travel, and Board Brief — the proof layer: signed artifacts mapped to controls, an append-only ledger, posture replay, and an executive summary.

The Evidence group is TrustFix's proof layer: a control-mapped evidence pack, the append-only signed ledger, point-in-time replay, and a board-ready brief — all backed by real signed artifacts.

Evidence

/evidence · reads GET /api/evidence, GET /api/evidence/matrix, GET /api/evidence/export?format=...

Maps real compliance controls to live, signed artifacts — proof, not promises. Two parts: a Control Coverage matrix mapping one signed artifact onto the controls auditors ask for across multiple frameworks, and detailed evidence with ledger-backed items. Each control status is REAL, PARTIAL, or EMPTY, and EMPTY controls are shown honestly rather than fabricated. Export a signed OSCAL pack, JSON, or CSV. See Evidence & compliance for the frameworks covered.

Trust Ledger

/trust-ledger · reads GET /api/ledger, GET /api/ledger/[id]/proof

The append-only, Merkle-linked, Ed25519-signed record. The chain is re-verified on every load (the CHAIN VERIFIED · N ENTRIES badge), and Verify proof returns and checks a Merkle inclusion proof server-side for any entry. The Authority Time-Machine panel replays your authority state as of any past ledger point, proven against the signed historical root. See Trust Ledger & proofs.

Time Travel

/time-travel · reads GET /api/timeline

Replays your real posture history. The trust line is reconstructed from org-level risk snapshots (trust = 100 − risk), and the event reel is real finding detect/resolve events and remediation-PR activity. Scrub the playhead to see trust and the reconstructed open-findings count at any past moment. Topology is not invented — thin history honestly shows as a short timeline.

Board Brief

/reports · reads GET /api/reports/board-brief?days=90

A period-over-period executive summary computed entirely from real rows, with per-KPI honesty — a KPI that lacks backing data is marked unavailable rather than guessed. It covers open critical findings, composite risk, MTTR, merged fix PRs and signed receipts written, plus what you stopped (top resolved criticals) and what you're watching (top open criticals) over a 7–365 day window. Deliberately absent: any blast-$ or "shadow identity" metric that has no agreed definition.