Merge evidence reports: proof of what ran

The problem it solves

A pull request opened by an agent describes the change, but rarely the checks behind it. Reviewers then assume tests ran when they may not have. This attestation lists, from recorded events, which checks happened and which did not.

It is built from the pipeline's own records, not from an agent's claims, so a generated summary cannot overstate the checks.

What it contains

• The models used, from the recorded agent invocations.
• The verifier outcome for each subtask.
• The build gates: passed, failed, or skipped because no build command exists.
• The security scan summary for the task.
• The holistic review at the end.
• The human gates: who approved the plan and who marked the task done.

A repository without a build command is listed as skipped_no_command, never as passed. That one rule is the point of the whole document.

When it is built

DevFlow assembles it when the pipeline finishes and stores it on the task. It is rebuilt during mark-done, so late rework is captured, and saved again after the done transition so the stored copy includes the mark-done gate.

When a task is reworked, the existing pull request body is refreshed to match the force-pushed commits. Assembly is fail-soft: a problem building it never blocks the pipeline or mark-done.

Where to read it

The Verification evidence section sits in the PR body, capped together with any screenshots under GitHub's 64 KB limit. Inside DevFlow, the Review tab shows the same data. An API endpoint returns it too, rebuilding on demand for older tasks.