Skip to content
best ai agent.inEvidence directory⌕ SearchExplore
Home / Trust / Evidence Methodology — What a Receipt Actually Contains

Trust & methodology

Evidence Methodology — What a Receipt Actually Contains

How BestAIAgent.in records evidence: the real EvidenceRecord fields, the verification check, and the difference between a verified identity and a verified capability claim.

Every verified entity on this site has at least one evidence record backing its identity. This page documents exactly what that record contains and how it's checked — matching the real code in lib/catalog-types.ts and lib/catalog.ts, not an idealized version of it.

What an evidence record contains

Each EvidenceRecord has these fields:

  • sourceUrl — the exact API or page URL fetched (e.g. api.github.com/repos/OWNER/REPO).
  • sourceType — one of official-repository-api, official-model-card, official-documentation, or official-site.
  • publisher — who controls the source (e.g. "GitHub", "Hugging Face", the vendor itself).
  • authority — primary or secondary (see /trust/source-classification).
  • retrievedAt — the ISO 8601 timestamp the source was actually fetched.
  • contentHash — a sha256: hash of a canonical JSON snapshot of the specific fields checked (for a GitHub repo: id, full name, default branch, archived status, visibility, size).
  • snapshot — the canonical object that was hashed, stored alongside the hash so it's inspectable.
  • status — verified, pending, stale, or rejected.

What counts as verified

isEvidenceVerified(record) requires all of: status === "verified", authority === "primary", a non-empty retrievedAt, and a contentHash matching /^sha256:[0-9a-f]{64}$/. An entity is publicly indexable only when its own verification field is "verified" and at least one of its evidence records passes that check.

An important limit: the hash format check is not a re-verification

The regex check confirms a hash is shaped like a real SHA-256 digest — it does not recompute the hash from the source and compare. That means the gate trusts whoever added the record to have actually fetched the source and hashed it honestly. This project has caught its own mistake here before: hand-typing an evidence record from memory instead of copying a script-generated one produced a syntactically valid but factually wrong hash. CONTRIBUTING.md documents this as a specific thing to check for in review.

What a verified identity does not cover

Verifying that a repository or model card exists, is public, and matches a specific name confirms identity — not pricing, capability, security posture, or benchmark performance. Those are separate claims that need their own evidence, and stay labeled unknown until they have it.

Related methodology pages

Source receipts

  • Internal — lib/catalog-types.ts (EvidenceRecord, Entity). The real types this page describes field-for-field.
  • Internal — lib/catalog.ts (isEvidenceVerified, isEntityIndexable). The real gate functions.
  • Internal — CONTRIBUTING.md. Documents the hand-typed-hash mistake referenced above as a real incident from this project's own history.

Last reviewed

  • Page last reviewed: 2026-09-02