# ToolHost — Evidence & Export (E-SEC-4 / E-COM-1)

*Anchor: project-docs/03-engineering-design/07-observability-evidence.md §1–3, §7 (retention);
00-FINAL-GOAL.md §5 #2.*

[Anchor: 00-FINAL-GOAL.md §5 #2] No call without evidence: no code path reaches a backend without
a sealed envelope; an `ok` call carries all stages, a denial carries executed stages with the
denying record last; a ring overflow is itself an evidenced gap record in the export.

## Rate/quota honesty (the same evidenced-and-alarmed discipline applies here)

[Anchor: 00-FINAL-GOAL.md §5 #5] Hard caps enforced within a +5%-per-replica local-allowance
tolerance (worst case N×5% overshoot); `allowance: 0` buys exact per-call accounting at a latency
cost; `strict` limits fail closed on store outage, non-strict fail open **with alarm** — a
documented choice, not an accident. (The bare words "hard caps, fail closed" without this
qualification are not a permitted claim.)

## Completeness by construction

Every call — allowed or denied — produces one envelope, allocated once per call, with one record
slot per pipeline stage (10 stages, known at compile time). Dispatch to a backend is gated on
`Complete(through: credentials)` — there is no path that reaches a backend without the record
already existing. A second write to the same stage is rejected outright (`ErrDuplicateStage`). An
`ok` outcome requires every stage's record present; a denial carries whatever stages executed
before the denying stage, with the denying record last and taxonomy-coded — never a synthesized
or reconstructed row.

## Redaction, displayed not claimed

Redaction runs before persistence — there is no unredacted copy that could exist to later
disclose. What you see on an envelope is a scrub count ("N fields scrubbed"), never the scrubbed
value itself; any loosening of a redaction class is itself a mandatory evidenced `kind: admin`
record with a field diff.

## Export

- **Pull:** an admin-audience API key (`gw_*`) against the same paginated
  `GET /admin/evidence` list your own operators use — tenancy-scoped by construction (there is no
  `org` parameter to get wrong).
- **Push:** a webhook sink pointed at your SIEM — at-least-once delivery, per-tenant ordered,
  spool-backed.
- **Schema:** additive-only JSON, RFC 3339 UTC timestamps, opaque IDs — the export contract does
  not change shape under you.

## Retention (see the data-handling artifact for the full posture)

The export horizon is bounded by your org's configured retention window, stated in the evidence
list's own footer rather than implied to be an infinite archive. The retention and deletion
mechanics are covered in full in `06-data-handling.md`.