Skip to content
Codevidence Docs

Reference — Declared Available now

Evidence record schema

One JSON file per annotated method, written by the build plugin at build time, named <Class>__<method>.json (dots in the class name become underscores). Every value is a string or null.

com_acme_checkout_ConsentService__recordConsent.json 
{
  "schemaVersion": "0.1",
  "kind": "declared",
  "control": {
    "id": "consent.capture",
    "framework": "GDPR:Art.30"
  },
  "artifact": {
    "sha256": "a1b2c3...",
    "class": "com.acme.checkout.ConsentService",
    "method": "recordConsent",
    "descriptor": "(Ljava/lang/String;)V"
  },
  "provenance": {
    "commit": "a3f9e21",
    "commitSource": "ci-env:GITHUB_SHA",
    "buildId": "ci-4821",
    "buildEnvironment": "ci",
    "timestamp": "2026-08-28T14:32:00Z",
    "serviceId": "checkout-service"
  }
}

Fields

Field Type Required Description
schemaVersion String Yes Version of the evidence record format, e.g. 0.1. Pre-1.0 — expect breaking changes.
kind String Yes Always "declared" for this schema. Distinguishes it from verified records.
control.id String Yes Matches the id on the @ComplianceControl annotation.
control.framework String Yes Matches the annotation’s framework value.
artifact.sha256 String Yes SHA-256 hash of the compiled .class file containing the annotated method.
artifact.class String Yes Fully-qualified class name, e.g. com.acme.checkout.ConsentService. Serialized under the JSON key class.
artifact.method String Yes Name of the annotated method.
artifact.descriptor String Yes JVM method descriptor — parameter and return types, e.g. (Ljava/lang/String;)V.
provenance.commit String / null Yes Git commit SHA the build was produced from. null when it could not be resolved (see commitSource) — never fabricated.
provenance.commitSource String Yes How commit was resolved: ci-env:<VAR>, git-rev-parse, manual-override, or unavailable.
provenance.buildId String Yes CI build identifier, or a generated local-… id outside CI.
provenance.buildEnvironment String Yes Where the build id came from: ci, local, or manual-override.
provenance.timestamp String (ISO 8601) Yes When the record was generated.
provenance.serviceId String Yes Identifier of the service the class belongs to — the Maven artifact ID / Gradle project name by default, overridable.

Related