Document pipeline

Compatibility: Pactmark 0.1.x. This scenario mirrors the evidence-document-pipeline example, which is fixture-only and performs no live URL fetch.

The situation

A documents team receives structured submissions — supplier declarations, conformity statements, compliance attestations — and must produce a durable record that a specific document, with specific bytes, passed specific checks at a specific time. This is the use case where Pactmark is closest to being only infrastructure. There is barely a model in it, and that is the point: the interesting property is reproducibility.

Content addressing first

Figure 1. The document becomes an artifact identified by its digest before anything examines it. Every later reference points at that digest.

const { artifactId, contentDigest } = await context.artifacts.write(
  documentBytes,
  { contentType: "application/json", source: "supplier-portal" },
);

From this moment there is exactly one answer to “which version was checked”, and it stays the same answer forever.

Deterministic verifiers

Figure 2. Three bindings, one result. Change the bytes, the verifier or the rubric and the previous result stops applying.

verifiers: [
  "schema@1",                    // the document matches its declared schema
  "checksum.declared@1",         // the declared checksum matches the actual bytes
  "citations.shape@2",           // referenced clauses are structurally resolvable
  "policy.required-fields@3",    // organisation policy fields are present
],

No model key required

Schema, checksum, policy and custom checks run without a provider account. The whole verification path is CI-friendly.

Reproducible by construction

Same bytes, same verifier registration, same rubric version → same result. That is what makes the record worth keeping.

Exporting

npx pactmark evidence export <runId> --format json > evidence.json
npx pactmark evidence export <runId> --format md   > evidence.md
npx pactmark evidence verify ./evidence.json

Both exports are deterministic. evidence verify re-checks the record’s internal references, so a record whose artifact or verification has gone missing surfaces as KAF_EVIDENCE_INVALID_REFERENCE rather than as a quiet gap.

Replay is the real test

npx pactmark replay <runId> --json

replay verifies a terminal run from stored events and artifacts without executing any tool or model. For a document pipeline this is the acceptance criterion:

Replay the run six months later

From backup, in a clean environment, on a different machine.

Confirm the artifact digest is unchanged

If the bytes moved, content addressing tells you immediately.

Confirm the same verifiers pass

Against the same rubric versions.

Confirm the evidence record still validates

Its references resolve, and its claim still says what it said.

If any of those fails, you have learned something important about your retention setup — which is far better than learning it during an audit.

The evidence

{
  "claim": {
    "statement": "Document sha256:9c04… matched its declared checksum and passed four deterministic verifiers on 2026-08-05.",
    "claimType": "deterministically_verified_document",
    "scope": "artifact sha256:9c04… under rubric set policy@3"
  },
  "supports": [
    "The declared checksum equals the digest of the stored bytes",
    "The document validates against schema@1",
    "All required policy fields are present under policy.required-fields@3",
    "Referenced clauses are structurally resolvable under citations.shape@2"
  ],
  "doesNotProve": [
    "That the statements in the document are true",
    "That the supplier who submitted it is who they claim to be",
    "That the referenced clauses say what the document implies",
    "Compliance with any regulation"
  ],
  "workSplit": {
    "ai": { "kind": "unavailable", "reason": "not_applicable" },
    "human": { "kind": "numeric", "value": 1, "unit": "submissions" },
    "description": "Deterministic pipeline; no model participated in verification."
  }
}

{"kind": "unavailable", "reason": "not_applicable"} is the honest way to say “no AI was involved in this part”. It is meaningfully different from recording zero, and the schema makes that distinction available.

Retention shape

Record	Typical retention
The document artifact	Longest — driven by the regulation behind the document
Verification results	With the artifact; they are meaningless separated from it
Evidence record	With the artifact
Run events	Operational window, often much shorter
Protected context	Shortest; it only existed to enable resume

Append-only run truth does not mean indefinite retention. Deleting events while retaining artifacts and evidence is a legitimate policy — as long as you know that replay will no longer work for those runs, and you decided that on purpose.

What you still own

A passing citation-shape verifier proves neither source availability nor factual truth. Deterministic verification is the strongest kind of check available here, and it still only checks what its rubric names.

Evidence document example

The runnable fixture-only pipeline.

Artifacts and verification

Bindings, rubrics and exception rules.

​The situation

​Content addressing first

​Deterministic verifiers

No model key required

Reproducible by construction

​Exporting

​Replay is the real test

​The evidence

​Retention shape

​What you still own

Evidence document example

Artifacts and verification

The situation

Content addressing first

Deterministic verifiers

Exporting

Replay is the real test

The evidence

Retention shape

What you still own