@crvouga/atlas 1.16.0 → 1.17.0

package/CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog: @crvouga/atlas
 
-## 1.16.0 (2026-10-29)
+## 1.17.0 (2026-10-29)
+
+### Features
+
+- read evidence applicability in the test explorer's list, sort and detail ([14181aa](https://github.com/crvouga/atlas/commit/14181aa391fb824c85364c4f5d93e1a6ccede176))
+
+## 1.16.0 (2026-10-28)
 
 ### Features
 

package/dist/reports/src/test-catalog.d.ts

@@ -6,6 +6,13 @@ import { RecordedSpecs } from './recorded-specs.js';
 export declare const TEST_CATALOG_VERSION = 1;
 /** Recorded results kept per test, newest first. Older ones are counted in no statistic. */
 export declare const HISTORY_PER_TEST = 100;
+/**
+ * The open `labels` (see docs/extending.md) that say what a result's evidence ran against and who vouches for it: `build`,
+ * `platform`, `applies-to` (builds or commits it is asserted to still hold for), `applies-to-by` (the policy or person that
+ * asserts it), `published-at` and `enriched-at` (when the evidence was published or enriched, epoch milliseconds or an ISO
+ * date: never when the checks ran). A test's current results carry them as `provenance`.
+ */
+export declare const APPLICABILITY_LABELS: readonly ["build", "platform", "applies-to", "applies-to-by", "published-at", "enriched-at"];
 /** One recorded result of a test: when, where, how it went and how long it took, and the layer and run it came from. */
 export type TestResultEntry = {
     /** When it was recorded, epoch ms. */
@@ -32,6 +39,10 @@ export type TestResultEntry = {
     readonly detail: string;
     /** The fingerprint of its spec text the layer recorded, when it recorded one: results with different revisions were recorded against different promises. Absent means not recorded, never "the same". */
     readonly specRevision?: string;
+    /** `modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, and on results other than a test's current ones. Advisory; never changes a status. */
+    readonly freshness?: 'unknown' | 'modified';
+    /** The labels of its layer and check that say what it ran against and who vouches for it: only those named in {@link APPLICABILITY_LABELS}. Present on a test's current results when it has any. Read by the viewer's evidence applicability; never decides a result. */
+    readonly provenance?: Readonly<Record<string, string>>;
     /** What it carried beyond its outcome (attachments, steps, retries, tags, labels), when anything. */
     readonly evidence?: EvidenceSummary;
     /** Its product-latency measurements (`kind: product-latency`), when it recorded any. Separate from `durationMs`, which is how long the test took (setup, waits and pacing included). */
@@ -82,6 +93,8 @@ export type CatalogSpec = {
     /** The group it belongs to: the spec's own domain, else the folder under `specs/`. */
     readonly domain: string;
     readonly kind: string;
+    /** The fingerprint of the spec text now (the promise), when the spec set or a layer recorded one. A result's `specRevision` is compared with it: different means the promise changed after the result was recorded. Absent: unknown, never "the same". */
+    readonly fingerprint?: string;
 };
 /** One test: what it is, its current status per environment, and how it has gone. */
 export type TestSummary = {

package/dist/reports/src/test-catalog.js

@@ -34,6 +34,13 @@ import { RecordedSpecs } from './recorded-specs.js';
 export const TEST_CATALOG_VERSION = 1;
 /** Recorded results kept per test, newest first. Older ones are counted in no statistic. */
 export const HISTORY_PER_TEST = 100;
+/**
+ * The open `labels` (see docs/extending.md) that say what a result's evidence ran against and who vouches for it: `build`,
+ * `platform`, `applies-to` (builds or commits it is asserted to still hold for), `applies-to-by` (the policy or person that
+ * asserts it), `published-at` and `enriched-at` (when the evidence was published or enriched, epoch milliseconds or an ISO
+ * date: never when the checks ran). A test's current results carry them as `provenance`.
+ */
+export const APPLICABILITY_LABELS = ['build', 'platform', 'applies-to', 'applies-to-by', 'published-at', 'enriched-at'];
 const FAILURE_RANK = { passed: 0, 'not-run': 1, running: 2, failed: 3 };
 /** How tests are ordered. */
 export const TEST_SORTS = ['spec', 'title', 'recent', 'slowest', 'failures', 'flaky', 'runs'];
@@ -409,6 +416,7 @@ export function catalogSpec(path, known) {
         title: entry?.title || (base ? base[0].toUpperCase() + base.slice(1) : path),
         domain: entry?.domain || folder,
         kind: entry?.kind || (/\.([^./]+)$/.exec(path)?.[1] ?? 'unknown'),
+        ...(entry?.fingerprint ? { fingerprint: entry.fingerprint } : {}),
     };
 }
 function statsOf(history, outcomes, tags, labels) {
@@ -464,11 +472,18 @@ function statsOf(history, outcomes, tags, labels) {
         firstSeenMs, lastSeenMs, lastPassedAtMs, lastFailedAtMs, runs: runs.size, branches,
     };
 }
-function outcomeOf(result) {
-    return entryOf(result.layer, result.row, result.layer.backend);
+/** A current result with what the layer recorded about its spec and about what it ran against (see {@link APPLICABILITY_LABELS}). */
+function outcomeOf(result, fingerprints = {}) {
+    const labels = { ...(result.layer.evidence?.labels ?? {}), ...(result.row.evidence?.labels ?? {}) };
+    const provenance = Object.fromEntries(APPLICABILITY_LABELS.filter(name => typeof labels[name] === 'string').map(name => [name, labels[name]]));
+    return {
+        ...entryOf(result.layer, result.row, result.layer.backend, fingerprints),
+        ...(result.layer.freshness ? { freshness: result.layer.freshness } : {}),
+        ...(Object.keys(provenance).length ? { provenance } : {}),
+    };
 }
-function summaryOf(slot, history, known) {
-    const outcomes = slot.outcomes.map(outcomeOf);
+function summaryOf(slot, history, known, fingerprintsOf) {
+    const outcomes = slot.outcomes.map(result => outcomeOf(result, fingerprintsOf(result.layer.id)));
     const tags = new Set();
     const artifactTags = new Set();
     const inheritedTags = new Set();
@@ -586,7 +601,8 @@ export function catalogModel(layers, sources = {}) {
     const known = (path) => recorded.get(path);
     const combined = combineEvidence({ specs: [], sha: null, changedFiles: [] }, layers);
     const slots = checkSlots(combined.unassigned);
-    const tests = slots.map(slot => summaryOf(slot, history, known));
+    const fingerprints = new Map(layers.map(entry => [entry.layer.id, entry.fingerprints]));
+    const tests = slots.map(slot => summaryOf(slot, history, known, id => fingerprints.get(id)));
     const byKey = new Map(tests.map(test => [test.key, test]));
     const haystacks = new Map(tests.map(test => [test.key, haystackOf(test)]));
     const counts = emptyCounts();

package/dist/schema/src/api.d.ts

@@ -2255,6 +2255,11 @@ export declare const TestResultEntrySchema: z.ZodObject<{
     backend: z.ZodString;
     detail: z.ZodString;
     specRevision: z.ZodOptional<z.ZodString>;
+    freshness: z.ZodOptional<z.ZodEnum<{
+        unknown: "unknown";
+        modified: "modified";
+    }>>;
+    provenance: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     evidence: z.ZodOptional<z.ZodObject<{
         attachments: z.ZodNumber;
         steps: z.ZodNumber;
@@ -2329,6 +2334,7 @@ export declare const TestSummarySchema: z.ZodObject<{
         title: z.ZodString;
         domain: z.ZodString;
         kind: z.ZodString;
+        fingerprint: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
     status: z.ZodEnum<{
         passed: "passed";
@@ -2359,6 +2365,11 @@ export declare const TestSummarySchema: z.ZodObject<{
         backend: z.ZodString;
         detail: z.ZodString;
         specRevision: z.ZodOptional<z.ZodString>;
+        freshness: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            modified: "modified";
+        }>>;
+        provenance: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         evidence: z.ZodOptional<z.ZodObject<{
             attachments: z.ZodNumber;
             steps: z.ZodNumber;
@@ -2586,6 +2597,7 @@ export declare const TestCatalogSchema: z.ZodObject<{
             title: z.ZodString;
             domain: z.ZodString;
             kind: z.ZodString;
+            fingerprint: z.ZodOptional<z.ZodString>;
             tests: z.ZodNumber;
             counts: z.ZodRecord<z.ZodEnum<{
                 passed: "passed";
@@ -2628,6 +2640,7 @@ export declare const TestCatalogSchema: z.ZodObject<{
             title: z.ZodString;
             domain: z.ZodString;
             kind: z.ZodString;
+            fingerprint: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
         status: z.ZodEnum<{
             passed: "passed";
@@ -2658,6 +2671,11 @@ export declare const TestCatalogSchema: z.ZodObject<{
             backend: z.ZodString;
             detail: z.ZodString;
             specRevision: z.ZodOptional<z.ZodString>;
+            freshness: z.ZodOptional<z.ZodEnum<{
+                unknown: "unknown";
+                modified: "modified";
+            }>>;
+            provenance: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             evidence: z.ZodOptional<z.ZodObject<{
                 attachments: z.ZodNumber;
                 steps: z.ZodNumber;
@@ -2860,6 +2878,7 @@ export declare const TestHistorySchema: z.ZodObject<{
             title: z.ZodString;
             domain: z.ZodString;
             kind: z.ZodString;
+            fingerprint: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
         status: z.ZodEnum<{
             passed: "passed";
@@ -2890,6 +2909,11 @@ export declare const TestHistorySchema: z.ZodObject<{
             backend: z.ZodString;
             detail: z.ZodString;
             specRevision: z.ZodOptional<z.ZodString>;
+            freshness: z.ZodOptional<z.ZodEnum<{
+                unknown: "unknown";
+                modified: "modified";
+            }>>;
+            provenance: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             evidence: z.ZodOptional<z.ZodObject<{
                 attachments: z.ZodNumber;
                 steps: z.ZodNumber;
@@ -3013,6 +3037,11 @@ export declare const TestHistorySchema: z.ZodObject<{
         backend: z.ZodString;
         detail: z.ZodString;
         specRevision: z.ZodOptional<z.ZodString>;
+        freshness: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            modified: "modified";
+        }>>;
+        provenance: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         evidence: z.ZodOptional<z.ZodObject<{
             attachments: z.ZodNumber;
             steps: z.ZodNumber;

package/dist/schema/src/api.js

@@ -432,13 +432,18 @@ export const TestResultEntrySchema = z.looseObject({
     backend: z.string(),
     detail: z.string().describe('Why it has its status, at most 500 characters'),
     specRevision: z.string().optional().describe('The fingerprint of its spec text that the layer recorded, when it recorded one. Two results with different revisions were recorded against different promises. Absent: not recorded, never assumed to match'),
+    freshness: z.enum(['modified', 'unknown']).optional().describe('`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, on results other than a test\'s current ones, and from an older server. Advisory; never changes a status'),
+    provenance: z.record(z.string(), z.string()).optional().describe('The labels of its layer and check that say what it ran against and who vouches for it: `build`, `platform`, `applies-to`, `applies-to-by`, `published-at`, `enriched-at`. Present on a test\'s current results when it has any, and absent from an older server. Never decides a result'),
     evidence: EvidenceSummarySchema.optional(),
     latency: z.array(MeasurementSchema).optional().describe('Its product-latency measurements (`kind: product-latency`), when it recorded any. Separate from `durationMs`, which is how long the test took')
 });
 const DurationStatsSchema = z.looseObject({
     count: z.number().int().nonnegative(), totalMs: z.number(), avgMs: z.number(), p50Ms: z.number(), p95Ms: z.number(), minMs: z.number(), maxMs: z.number(), lastMs: z.number()
 });
-const CatalogSpecSchema = z.looseObject({ path: z.string(), title: z.string(), domain: z.string(), kind: z.string() });
+const CatalogSpecSchema = z.looseObject({
+    path: z.string(), title: z.string(), domain: z.string(), kind: z.string(),
+    fingerprint: z.string().optional().describe('The fingerprint of the spec text now (the promise). Compare it with a result\'s `specRevision`: different means the promise changed after the result was recorded. Absent: unknown, never "the same". Absent from an older server')
+});
 /** One test of the catalog: what it is, its current result per environment, and how it has gone over its recorded history. */
 export const TestSummarySchema = z.looseObject({
     key: z.string().describe('The test\'s identity, `JSON.stringify([specPath, id])`. Pass it to `/api/reports/tests/history?key=`'),

package/docs/extending.md

@@ -30,7 +30,7 @@ carry any of these. Every one is optional.
 | `annotations[]` | Notes about the result: a warning, a deprecation, an accessibility finding, a coverage figure. |
 | `attempts[]` | Every try, when the check was retried. |
 | `tags[]` | Free labels to filter by: `smoke`, `payments`. |
-| `labels{}` | Facts about the result that are not its identity: `owner`, `severity`, `browser`, `build`. The viewer reads `build`, `platform`, `applies-to` and `applies-to-by` to tell whether evidence applies to a release (see [the viewer conventions](ui.md#behaviors-read-watch-inspect)). `behavior-id` and `example-id` declare a stable id for the behavior and for one example of an outline, and `outline` names the outline; the [catalog health](server.md#reading-the-report-as-an-agent) report counts them and names an id shared by several checks. They never change which check a result belongs to. |
+| `labels{}` | Facts about the result that are not its identity: `owner`, `severity`, `browser`, `build`. The viewer reads `build`, `platform`, `applies-to` and `applies-to-by` to tell whether evidence applies to a release, and `published-at` and `enriched-at` (epoch milliseconds or an ISO date) to show when it was published or enriched apart from when the checks ran (see [the viewer conventions](ui.md#behaviors-read-watch-inspect)). `behavior-id` and `example-id` declare a stable id for the behavior and for one example of an outline, and `outline` names the outline; the [catalog health](server.md#reading-the-report-as-an-agent) report counts them and names an id shared by several checks. They never change which check a result belongs to. |
 | `scope{}` | What the evidence does and does not show: surface, device kind, synthetic data, scripted dependencies, audio, pacing, what was asserted and its limits. Unknown when absent. See [Evidence scope](rich-evidence.md#evidence-scope). |
 | `links[]` | Where to read more: the CI run, the issue, the trace client. |
 | `extensions{}` | Structured data of your own or a tool's, under a name you own. |

package/docs/reference/reports.md

@@ -9578,6 +9578,17 @@ export const HISTORY_PER_TEST = …
 
 Recorded results kept per test, newest first. Older ones are counted in no statistic.
 
+#### `APPLICABILITY_LABELS`
+
+```ts
+export const APPLICABILITY_LABELS = …
+```
+
+The open `labels` (see docs/extending.md) that say what a result's evidence ran against and who vouches for it: `build`,
+`platform`, `applies-to` (builds or commits it is asserted to still hold for), `applies-to-by` (the policy or person that
+asserts it), `published-at` and `enriched-at` (when the evidence was published or enriched, epoch milliseconds or an ISO
+date: never when the checks ran). A test's current results carry them as `provenance`.
+
 #### `TestResultEntry`
 
 ```ts
@@ -9606,6 +9617,10 @@ export type TestResultEntry = {
   readonly detail: string;
   /** The fingerprint of its spec text the layer recorded, when it recorded one: results with different revisions were recorded against different promises. Absent means not recorded, never "the same". */
   readonly specRevision?: string;
+  /** `modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, and on results other than a test's current ones. Advisory; never changes a status. */
+  readonly freshness?: 'unknown' | 'modified';
+  /** The labels of its layer and check that say what it ran against and who vouches for it: only those named in {@link APPLICABILITY_LABELS}. Present on a test's current results when it has any. Read by the viewer's evidence applicability; never decides a result. */
+  readonly provenance?: Readonly<Record<string, string>>;
   /** What it carried beyond its outcome (attachments, steps, retries, tags, labels), when anything. */
   readonly evidence?: EvidenceSummary;
   /** Its product-latency measurements (`kind: product-latency`), when it recorded any. Separate from `durationMs`, which is how long the test took (setup, waits and pacing included). */
@@ -9680,6 +9695,8 @@ export type CatalogSpec = {
   /** The group it belongs to: the spec's own domain, else the folder under `specs/`. */
   readonly domain: string;
   readonly kind: string;
+  /** The fingerprint of the spec text now (the promise), when the spec set or a layer recorded one. A result's `specRevision` is compared with it: different means the promise changed after the result was recorded. Absent: unknown, never "the same". */
+  readonly fingerprint?: string;
 };
 ```
 

package/docs/ui.md

@@ -91,6 +91,14 @@ when Watch is on screen.
   what they know with labels: `build`, `platform`, and `applies-to` with `applies-to-by` (the policy that asserts the
   evidence still holds for those builds; without it the assertion is refused). The "Stale or unverified" filter
   (`evidence=stale`) lists every behavior whose evidence does not apply, including those with none.
+- The test explorer makes the same reading of every test from the catalog (`explorer/applicability.ts`): the catalog
+  carries the spec's fingerprint now (`spec.fingerprint`) and, on each current result, `specRevision`, `freshness` and
+  `provenance` (the labels above), all optional. The same address names (`release`, `releaseSha`, `releasePlatform`,
+  `evidence=stale`) give the "Stale or unverified" button, the "Stale evidence first" sort, a verdict badge on rows
+  (stale always; unknown or none when a release is named or evidence is filtered or sorted), and the summary in test
+  detail. Layers carry no publication time, because a layer's id is the digest of its content and a time of upload in
+  it would make a retried publish a different layer: a producer that knows states `published-at` and `enriched-at`
+  labels, shown apart from "Checks ran", which alone is the age.
 - A recording is always labelled illustrative: it shows one run and does not approve a behavior for production.
   `demo`/`representative` tags only add a "Representative demo" label.
 - The spec index searches titles, paths and declared domains, and can group by the domain from spec metadata (specs with

package/llms-full.txt

@@ -3204,7 +3204,7 @@ carry any of these. Every one is optional.
 | `annotations[]` | Notes about the result: a warning, a deprecation, an accessibility finding, a coverage figure. |
 | `attempts[]` | Every try, when the check was retried. |
 | `tags[]` | Free labels to filter by: `smoke`, `payments`. |
-| `labels{}` | Facts about the result that are not its identity: `owner`, `severity`, `browser`, `build`. The viewer reads `build`, `platform`, `applies-to` and `applies-to-by` to tell whether evidence applies to a release (see [the viewer conventions](ui.md#behaviors-read-watch-inspect)). `behavior-id` and `example-id` declare a stable id for the behavior and for one example of an outline, and `outline` names the outline; the [catalog health](server.md#reading-the-report-as-an-agent) report counts them and names an id shared by several checks. They never change which check a result belongs to. |
+| `labels{}` | Facts about the result that are not its identity: `owner`, `severity`, `browser`, `build`. The viewer reads `build`, `platform`, `applies-to` and `applies-to-by` to tell whether evidence applies to a release, and `published-at` and `enriched-at` (epoch milliseconds or an ISO date) to show when it was published or enriched apart from when the checks ran (see [the viewer conventions](ui.md#behaviors-read-watch-inspect)). `behavior-id` and `example-id` declare a stable id for the behavior and for one example of an outline, and `outline` names the outline; the [catalog health](server.md#reading-the-report-as-an-agent) report counts them and names an id shared by several checks. They never change which check a result belongs to. |
 | `scope{}` | What the evidence does and does not show: surface, device kind, synthetic data, scripted dependencies, audio, pacing, what was asserted and its limits. Unknown when absent. See [Evidence scope](rich-evidence.md#evidence-scope). |
 | `links[]` | Where to read more: the CI run, the issue, the trace client. |
 | `extensions{}` | Structured data of your own or a tool's, under a name you own. |
@@ -4519,6 +4519,14 @@ when Watch is on screen.
   what they know with labels: `build`, `platform`, and `applies-to` with `applies-to-by` (the policy that asserts the
   evidence still holds for those builds; without it the assertion is refused). The "Stale or unverified" filter
   (`evidence=stale`) lists every behavior whose evidence does not apply, including those with none.
+- The test explorer makes the same reading of every test from the catalog (`explorer/applicability.ts`): the catalog
+  carries the spec's fingerprint now (`spec.fingerprint`) and, on each current result, `specRevision`, `freshness` and
+  `provenance` (the labels above), all optional. The same address names (`release`, `releaseSha`, `releasePlatform`,
+  `evidence=stale`) give the "Stale or unverified" button, the "Stale evidence first" sort, a verdict badge on rows
+  (stale always; unknown or none when a release is named or evidence is filtered or sorted), and the summary in test
+  detail. Layers carry no publication time, because a layer's id is the digest of its content and a time of upload in
+  it would make a retried publish a different layer: a producer that knows states `published-at` and `enriched-at`
+  labels, shown apart from "Checks ran", which alone is the age.
 - A recording is always labelled illustrative: it shows one run and does not approve a behavior for production.
   `demo`/`representative` tags only add a "Representative demo" label.
 - The spec index searches titles, paths and declared domains, and can group by the domain from spec metadata (specs with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/atlas",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Atlas: specs of any kind, reported as layered evidence. Publish checks from any runner (JUnit, CTRF, a script), combine them across nodes, branches, environments and backends, gate CI on the result, and run statecharts against the real app.",
   "license": "MIT",
   "type": "module",

package/packages/schema/schemas/test-catalog.schema.json

@@ -529,6 +529,10 @@
               "kind": {
                 "type": "string"
               },
+              "fingerprint": {
+                "description": "The fingerprint of the spec text now (the promise). Compare it with a result's `specRevision`: different means the promise changed after the result was recorded. Absent: unknown, never \"the same\". Absent from an older server",
+                "type": "string"
+              },
               "tests": {
                 "type": "integer",
                 "minimum": 0,
@@ -747,6 +751,10 @@
                   },
                   "kind": {
                     "type": "string"
+                  },
+                  "fingerprint": {
+                    "description": "The fingerprint of the spec text now (the promise). Compare it with a result's `specRevision`: different means the promise changed after the result was recorded. Absent: unknown, never \"the same\". Absent from an older server",
+                    "type": "string"
                   }
                 },
                 "required": [
@@ -869,6 +877,24 @@
                   "description": "The fingerprint of its spec text that the layer recorded, when it recorded one. Two results with different revisions were recorded against different promises. Absent: not recorded, never assumed to match",
                   "type": "string"
                 },
+                "freshness": {
+                  "description": "`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, on results other than a test's current ones, and from an older server. Advisory; never changes a status",
+                  "type": "string",
+                  "enum": [
+                    "modified",
+                    "unknown"
+                  ]
+                },
+                "provenance": {
+                  "description": "The labels of its layer and check that say what it ran against and who vouches for it: `build`, `platform`, `applies-to`, `applies-to-by`, `published-at`, `enriched-at`. Present on a test's current results when it has any, and absent from an older server. Never decides a result",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {
+                    "type": "string"
+                  }
+                },
                 "evidence": {
                   "type": "object",
                   "properties": {

package/packages/schema/schemas/test-history.schema.json

@@ -45,6 +45,10 @@
                 },
                 "kind": {
                   "type": "string"
+                },
+                "fingerprint": {
+                  "description": "The fingerprint of the spec text now (the promise). Compare it with a result's `specRevision`: different means the promise changed after the result was recorded. Absent: unknown, never \"the same\". Absent from an older server",
+                  "type": "string"
                 }
               },
               "required": [
@@ -167,6 +171,24 @@
                 "description": "The fingerprint of its spec text that the layer recorded, when it recorded one. Two results with different revisions were recorded against different promises. Absent: not recorded, never assumed to match",
                 "type": "string"
               },
+              "freshness": {
+                "description": "`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, on results other than a test's current ones, and from an older server. Advisory; never changes a status",
+                "type": "string",
+                "enum": [
+                  "modified",
+                  "unknown"
+                ]
+              },
+              "provenance": {
+                "description": "The labels of its layer and check that say what it ran against and who vouches for it: `build`, `platform`, `applies-to`, `applies-to-by`, `published-at`, `enriched-at`. Present on a test's current results when it has any, and absent from an older server. Never decides a result",
+                "type": "object",
+                "propertyNames": {
+                  "type": "string"
+                },
+                "additionalProperties": {
+                  "type": "string"
+                }
+              },
               "evidence": {
                 "type": "object",
                 "properties": {
@@ -820,6 +842,24 @@
             "description": "The fingerprint of its spec text that the layer recorded, when it recorded one. Two results with different revisions were recorded against different promises. Absent: not recorded, never assumed to match",
             "type": "string"
           },
+          "freshness": {
+            "description": "`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, on results other than a test's current ones, and from an older server. Advisory; never changes a status",
+            "type": "string",
+            "enum": [
+              "modified",
+              "unknown"
+            ]
+          },
+          "provenance": {
+            "description": "The labels of its layer and check that say what it ran against and who vouches for it: `build`, `platform`, `applies-to`, `applies-to-by`, `published-at`, `enriched-at`. Present on a test's current results when it has any, and absent from an older server. Never decides a result",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
           "evidence": {
             "type": "object",
             "properties": {

package/packages/server/openapi.json

@@ -20619,6 +20619,10 @@
                     "kind": {
                       "type": "string"
                     },
+                    "fingerprint": {
+                      "description": "The fingerprint of the spec text now (the promise). Compare it with a result's `specRevision`: different means the promise changed after the result was recorded. Absent: unknown, never \"the same\". Absent from an older server",
+                      "type": "string"
+                    },
                     "tests": {
                       "type": "integer",
                       "minimum": 0,
@@ -20837,6 +20841,10 @@
                         },
                         "kind": {
                           "type": "string"
+                        },
+                        "fingerprint": {
+                          "description": "The fingerprint of the spec text now (the promise). Compare it with a result's `specRevision`: different means the promise changed after the result was recorded. Absent: unknown, never \"the same\". Absent from an older server",
+                          "type": "string"
                         }
                       },
                       "required": [
@@ -20959,6 +20967,24 @@
                         "description": "The fingerprint of its spec text that the layer recorded, when it recorded one. Two results with different revisions were recorded against different promises. Absent: not recorded, never assumed to match",
                         "type": "string"
                       },
+                      "freshness": {
+                        "description": "`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, on results other than a test's current ones, and from an older server. Advisory; never changes a status",
+                        "type": "string",
+                        "enum": [
+                          "modified",
+                          "unknown"
+                        ]
+                      },
+                      "provenance": {
+                        "description": "The labels of its layer and check that say what it ran against and who vouches for it: `build`, `platform`, `applies-to`, `applies-to-by`, `published-at`, `enriched-at`. Present on a test's current results when it has any, and absent from an older server. Never decides a result",
+                        "type": "object",
+                        "propertyNames": {
+                          "type": "string"
+                        },
+                        "additionalProperties": {
+                          "type": "string"
+                        }
+                      },
                       "evidence": {
                         "type": "object",
                         "properties": {
@@ -22006,6 +22032,10 @@
                       },
                       "kind": {
                         "type": "string"
+                      },
+                      "fingerprint": {
+                        "description": "The fingerprint of the spec text now (the promise). Compare it with a result's `specRevision`: different means the promise changed after the result was recorded. Absent: unknown, never \"the same\". Absent from an older server",
+                        "type": "string"
                       }
                     },
                     "required": [
@@ -22128,6 +22158,24 @@
                       "description": "The fingerprint of its spec text that the layer recorded, when it recorded one. Two results with different revisions were recorded against different promises. Absent: not recorded, never assumed to match",
                       "type": "string"
                     },
+                    "freshness": {
+                      "description": "`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, on results other than a test's current ones, and from an older server. Advisory; never changes a status",
+                      "type": "string",
+                      "enum": [
+                        "modified",
+                        "unknown"
+                      ]
+                    },
+                    "provenance": {
+                      "description": "The labels of its layer and check that say what it ran against and who vouches for it: `build`, `platform`, `applies-to`, `applies-to-by`, `published-at`, `enriched-at`. Present on a test's current results when it has any, and absent from an older server. Never decides a result",
+                      "type": "object",
+                      "propertyNames": {
+                        "type": "string"
+                      },
+                      "additionalProperties": {
+                        "type": "string"
+                      }
+                    },
                     "evidence": {
                       "type": "object",
                       "properties": {
@@ -22781,6 +22829,24 @@
                   "description": "The fingerprint of its spec text that the layer recorded, when it recorded one. Two results with different revisions were recorded against different promises. Absent: not recorded, never assumed to match",
                   "type": "string"
                 },
+                "freshness": {
+                  "description": "`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent for a clean checkout, on results other than a test's current ones, and from an older server. Advisory; never changes a status",
+                  "type": "string",
+                  "enum": [
+                    "modified",
+                    "unknown"
+                  ]
+                },
+                "provenance": {
+                  "description": "The labels of its layer and check that say what it ran against and who vouches for it: `build`, `platform`, `applies-to`, `applies-to-by`, `published-at`, `enriched-at`. Present on a test's current results when it has any, and absent from an older server. Never decides a result",
+                  "type": "object",
+                  "propertyNames": {
+                    "type": "string"
+                  },
+                  "additionalProperties": {
+                    "type": "string"
+                  }
+                },
                 "evidence": {
                   "type": "object",
                   "properties": {

package/packages/visualizer/src/evidence/applicability-view.tsx

@@ -111,6 +111,26 @@ export function ApplicabilitySummary({ assessment, release }: { assessment: Asse
             </time>
           </Text>
         </Text>
+        {facts.publishedAtMs !== null && (
+          <Text span inherit data-published>
+            Published:{' '}
+            <Text span inherit fw={600}>
+              <time dateTime={new Date(facts.publishedAtMs).toISOString()} title={exactTime(facts.publishedAtMs)}>
+                {exactTime(facts.publishedAtMs)} ({ago(facts.publishedAtMs, now)})
+              </time>
+            </Text>
+          </Text>
+        )}
+        {facts.enrichedAtMs !== null && (
+          <Text span inherit data-enriched>
+            Enriched:{' '}
+            <Text span inherit fw={600}>
+              <time dateTime={new Date(facts.enrichedAtMs).toISOString()} title={exactTime(facts.enrichedAtMs)}>
+                {exactTime(facts.enrichedAtMs)} ({ago(facts.enrichedAtMs, now)})
+              </time>
+            </Text>
+          </Text>
+        )}
         <Text span inherit>
           Build:{' '}
           <Text span inherit fw={600}>
@@ -167,13 +187,17 @@ export function ApplicabilitySummary({ assessment, release }: { assessment: Asse
  */
 export function ApplicabilityControls({
   state,
-  stale,
-  total
+  stale = 0,
+  total = 0,
+  filter = true
 }: {
   state: ApplicabilityState;
-  /** How many behaviors have stale or unverified evidence. */
-  stale: number;
-  total: number;
+  /** How many behaviors (or tests) have stale or unverified evidence. Only shown with the filter. */
+  stale?: number;
+  /** How many behaviors (or tests) there are. Only shown with the filter. */
+  total?: number;
+  /** Whether to offer the stale-or-unverified filter here; a caller that offers it elsewhere sets this false. */
+  filter?: boolean;
 }) {
   const { release, setRelease, onlyStale, setOnlyStale } = state;
   return (
@@ -208,21 +232,23 @@ export function ApplicabilityControls({
             A platform alone does not name a release. Add its build or commit.
           </Text>
         )}
-        <Group role="group" aria-label="Evidence filter" gap="sm">
-          <Button type="button" aria-pressed={!onlyStale} onClick={() => setOnlyStale(false)} variant={onlyStale ? 'subtle' : 'light'}>
-            All evidence{' '}
-            <Text span inherit>
-              {total}
-            </Text>
-          </Button>
-          <Button type="button" aria-pressed={onlyStale} onClick={() => setOnlyStale(true)} variant={onlyStale ? 'light' : 'subtle'}>
-            Stale or unverified{' '}
-            <Text span inherit>
-              {stale}
-            </Text>
-          </Button>
-        </Group>
-        {onlyStale && stale === 0 && (
+        {filter && (
+          <Group role="group" aria-label="Evidence filter" gap="sm">
+            <Button type="button" aria-pressed={!onlyStale} onClick={() => setOnlyStale(false)} variant={onlyStale ? 'subtle' : 'light'}>
+              All evidence{' '}
+              <Text span inherit>
+                {total}
+              </Text>
+            </Button>
+            <Button type="button" aria-pressed={onlyStale} onClick={() => setOnlyStale(true)} variant={onlyStale ? 'light' : 'subtle'}>
+              Stale or unverified{' '}
+              <Text span inherit>
+                {stale}
+              </Text>
+            </Button>
+          </Group>
+        )}
+        {filter && onlyStale && stale === 0 && (
           <Text role="status" component="div" c="dimmed">
             Every behavior has evidence that applies.
           </Text>