Make the evidence boundary visible.
Trust should come from inspectable mechanisms and bounded claims, not from a broad “secure” or “AI-powered” label.
Exact identity
Bind evidence to source/archive/configuration fingerprints and invalidate it when decision-critical inputs change.
No false green
Unavailable native, device, store, network or deployment evidence stays pending—not PASS.
Fail narrower
Missing/conflicting authority should reduce capability or preserve uncertainty rather than silently expand permission.
Public claim discipline
Do not advertise a store, price, certification, provider capability or platform behavior until the corresponding evidence exists.
Separate user decisions
Advisory analysis should remain distinguishable from source facts and user-owned final decisions.
Provider transparency
External stores, AI providers and data services remain separate trust/privacy boundaries under their own terms and availability.
How to inspect RuleOak's open-source claims
The v0.50.0 project publishes source manifests, reproducibility checks, compatibility boundaries, release-verification guidance and security/non-goal documentation. These improve auditability without pretending to be independent certification.
Claims should be evidence-scoped.
Source checks, CI, packaging, native execution, deployment and independent review prove different things.