What counts as evidence

passo.build uses evidence to decide whether work is ready for review, ready to deploy, or blocked.

Evidence is not paperwork. It is the proof that a claim is true.

Claim	Evidence that supports it
"The bug is fixed."	PR link, diff, failing test before the fix, passing test after the fix.
"The UI works."	Browser screenshot or trace for the relevant screen and viewport.
"The build is releasable."	Build command output and CI/deploy job id.
"The API is healthy."	Health check, smoke request, logs for the tested route.
"Secrets are not exposed."	Secret scan result and code review of env/server boundaries.
"Deploy can be rolled back."	Rollback command, teardown proof, or prior deployment id.
"The cost estimate is acceptable."	Provider comparison, sizing assumptions, spend cap, account mode.

Evidence by role

Different people need different proof.

Reader	What they usually need
Founder or product owner	Screenshot, plain-English outcome, cost estimate, clear next decision.
Developer	Test output, diff, PR link, failing/passing cases.
DevOps reviewer	Build/deploy job id, smoke result, rollback or teardown path.
Security reviewer	Secret handling, auth boundary, tenant/project isolation, audit trail.

What evidence is not

These are not enough on their own:

• "The agent said it is done."
• "The code looks right."
• "The local app opened once."
• "The cloud provider accepted the command."
• "No one complained during the test."

A task can be ready for review before it is accepted. It is accepted only when the controller sees enough evidence for the risk level.

Minimum evidence before deploy

Before deploy, expect at least:

• accepted product scope;
• security gates with no unresolved critical blockers;
• build output;
• smoke check plan;
• provider/region/sizing decision;
• spend cap and account mode;
• rollback or teardown path;
• explicit human approval for cloud changes.