Share Evidence

Evidence share links give reviewers a read-only view of a completed runtime's signed evidence. The page shows runtime metadata, signature status, SHA-256 values, and artifact entries. Reviewers do not need a Tachyonic account.

Use share links only for evidence you are allowed to disclose. The default production runtime path has been live-proven with signed evidence and public reviewer rendering. Paid regional evidence should still be verified with tachyonic verify before you rely on it in a review package.

Requirements

• A completed runtime.
• An API key or CLI token with scan:write.
• Signed artifacts available for the runtime.

Expiry limits

Reviewer links are capped by the lower of the plan's reviewer-link limit and the remaining evidence retention window.

The API returns HTTP 402 with upgrade_required: true when expires_in_hours exceeds your plan. The API returns HTTP 410 when the signed evidence has passed the plan retention window or is too close to expiry to create a one-hour reviewer link. Existing reviewer links stop loading after the evidence retention window even if the token itself has not expired.

Create a link

export RID=<runtime_id>

curl -sS -X POST \
  -H "x-api-key: $TACHYONIC_PLATFORM_KEY" \
  -H "content-type: application/json" \
  -d '{"expires_in_hours":72}' \
  "https://api.tachyonic.sh/api/v1/runtimes/$RID/share" | jq .

Response:

{
  "id": "c526c5dd-643a-4a2b-b0f8-887104395615",
  "runtime_id": "tachyon-rt-b885be17bce342a39a598a29f2cb981d",
  "url": "https://platform.tachyonic.co/share/evidence/<token>",
  "expires_at": "2026-06-09T12:00:00.000Z",
  "max_expires_in_hours": 72,
  "evidence_retention": {
    "retained": true,
    "retention_hours": 72,
    "anchor_at": "2026-06-06T12:00:00.000Z",
    "expires_at": "2026-06-09T12:00:00.000Z",
    "remaining_hours": 71,
    "source": "artifact.collection_updated_at"
  }
}

Send the url to your reviewer.

What the reviewer sees

The public page renders:

• verification status
• signing key ID
• runtime ID
• SHA-256 digest
• artifact list
• link expiry time

Opening the page records an evidence_verified event for the Program 1 funnel when signed evidence is present.

Retain a local copy

A share link is not a substitute for retaining the evidence bundle. Download the bundle and manifest before the retention window closes:

mkdir -p "tachyonic-evidence/$RID"

curl -sS \
  -H "x-api-key: $TACHYONIC_PLATFORM_KEY" \
  "https://api.tachyonic.sh/api/v1/runtimes/$RID/artifacts?limit=100" \
  | jq -r '.data[]
      | select(.type == "finding_bundle_v1" or .type == "evidence_manifest_v1")
      | [.filename, .url]
      | @tsv' \
  | while IFS="$(printf '\t')" read -r name url; do
      curl -fsSL "$url" -o "tachyonic-evidence/$RID/$name"
    done

tachyonic verify "tachyonic-evidence/$RID"

Current boundaries

Share links are for signed evidence review. They are not supply-chain provenance, hosted signing identity, structured runtime attestation, or a legal conclusion. Structured runtime attestation is planned for Phase B.