VIGIL — Evidence
The Oracle model: lead versus fact
VIGIL refuses to guess. An observation stays a lead until an independent authority re-verifies it into a confirmed fact — and if the check does not fire, the item is not quietly promoted.
What an Oracle is
An Oracle is a deterministic rule that re-runs against retained evidence. It does not produce the original observation; it independently checks whether that observation holds. A missing Oracle, absent input, or ambiguous evidence produces a refusal or a skip — never an assumed success.
Proof that survives leaving the tool
A confirmed fact is signed and can be re-verified offline: the raw evidence, its digest, its context, and its provenance are retained, and a compatible Oracle can re-run later. A report always distinguishes the levels of truth — what is proven, and what is merely observed.
What the checks do and do not prove
The honesty of the model is in its limits. A posture check proves a retained state, not that a live attack was carried out. A request-side parse-proof proves a hostile structure was present, not that the backend was exploited. The absence of a signal is not proof that no vulnerability exists — it means VIGIL does not hold enough evidence to confirm one.