The sixteen fields of one Evidence record
A table of the Evidence record ev_b492c85eb9570bd5f8e8 for analyze_function on _percent_change in ledger-arm64-O1, one row per field with its captured value: the subject digest, format and architecture, the Ghidra 12.1.4 provider, the analysis profile digest, predicate type, operation, parameters, raw and normalized results, confidence observed, the artifact bytes as authority, a null environment, ten limitations, complete relationship coverage, and empty locations and links. Two rows are drawn dashed, subject.name and subject.local_path, because the evidence id hashes every other row and not these two.
EV_B492C85EB957, ANALYZE_FUNCTION _PERCENT_CHANGE
FIELD NOTES
Evidence record, 16 fields, strict schema
evidence_id
ev_b492c85eb9570bd5f8e8
SHA-256 of the solid rows
subject.name
ledger-arm64-O1
display only, not hashed
subject.digest.sha256
01b5d08b08fb94678be5
identity of the analysed bytes
subject.format
mach-o
subject.architecture
arm64
subject.local_path
$CAPTURE/fixtures/ledger-arm64-O1
display only, not hashed
provider
ghidra, Ghidra, 12.1.4
the engine, with its version
analysis_profile
digest 3fc72c9b4b78498fb9
the committed Ghidra settings
predicate_type
rea.analysis
operation
analyze_function
parameters
{"procedure": "_percent_change"}
the caller input, in full
raw_result
object: the Ghidra report
provider form, or null
normalized_result
object: the dossier, 16 keys
what the agent reads
confidence
observed
observed, derived, or inferred
authority
the artifact bytes
one of five source kinds
environment
null
limitations
10 strings
kept with the claim, in full
relationship_coverage
complete
in the hash also when null
locations
[]
evidence_links
[]
ev_ ids this record derives from
Solid rows enter the id hash. Dashed rows are display fields. Digests show their first hex digits.