Recorded history / identity
Same bytes.
Different permission to trust.
A signed layout says which construction history is admissible. Five actual fixture executions produce one byte-identical artifact; signatures, missing steps, and material continuity still distinguish their verification results.
loadingloadingREJECTED01 / Native policy
Declared supply chain
These definitions come from the project-owner-signed layout. Rules remain native records with exact source pointers.
Command nuance. In the pinned in-toto specification, `expected_command` mismatch produces a warning. The optional strict rejection is an Onto2D policy and is displayed separately.
02 / Signed records
Actual execution
Select a frozen execution. Every option below is an actual signed fixture record, not a generated counterfactual.
03 / Deterministic result
Verification
04 / Declared analysis space
Counterfactuals
Only these four routes participate in Historical Load. The actual baseline is marked separately; no counterfactual is promoted to fact.
Bounded Onto2D result
Historical Load
How much more history does the shortest policy-conforming route require than the shortest merely executable route?
What the result does - and does not - say
Native
Signed layout, link bodies, key authorization, SHA-256 artifact records, and native verification warnings.
Derived
Verifier checks, scenario comparison, path classification, and four cost-relative load values.
Counterfactual
Three declared alternative routes. They bound the analysis but are never labeled actual executions.
Unknown
Actor intent, host trust beyond signed records, and whether the owner's policy is a good security policy.