Share Evidence

Evidence share links give reviewers a read-only view of a completed runtime's signed evidence. The page shows runtime metadata, signature status, SHA-256 values, and artifact entries. Reviewers do not need a Tachyonic account.

Use share links only for evidence you are allowed to disclose. The default production runtime path has been live-proven with signed evidence and public reviewer rendering. Regional signing, retention, and sharing must be checked separately. Verify the exact bundle before relying on it in a review package.

Requirements

A completed runtime.
An API key or CLI token with scan:write.
Signed artifacts available for the runtime.

Expiry limits

Reviewer links are capped by the lower of the plan's reviewer-link limit and the remaining evidence retention window.

Plan	Evidence retention	Maximum reviewer link expiry
Free	72 hours	72 hours
Pro	30 days	14 days
Team	90 days	30 days
Enterprise	365 days	30 days

The API returns HTTP 402 with upgrade_required: true when expires_in_hours exceeds your plan. The API returns HTTP 410 when the signed evidence has passed the plan retention window or is too close to expiry to create a one-hour reviewer link. Existing reviewer links stop loading after the evidence retention window even if the token itself has not expired.

Create a link

Supply an existing API key through TACHYONIC_API_KEY in the process environment and the runtime ID through RID. Read the key in-process:

import json
import os
from urllib.request import Request, urlopen

request = Request(
    "https://api.tachyonic.sh/api/v1/runtimes/" + os.environ["RID"] + "/share",
    data=json.dumps({"expires_in_hours": 72}).encode(),
    headers={"x-api-key": os.environ["TACHYONIC_API_KEY"],
             "content-type": "application/json"},
    method="POST",
)
with urlopen(request, timeout=30) as response:
    link = json.load(response)
# Use link["url"] in a private handoff to the intended reviewer. Do not log it.

Response:

{
  "id": "c526c5dd-643a-4a2b-b0f8-887104395615",
  "runtime_id": "tachyonic-rt-b885be17bce342a39a598a29f2cb981d",
  "url": "https://platform.tachyonic.co/share/evidence/<token>",
  "expires_at": "2026-06-09T12:00:00.000Z",
  "max_expires_in_hours": 72,
  "evidence_retention": {
    "retained": true,
    "retention_hours": 72,
    "anchor_at": "2026-06-06T12:00:00.000Z",
    "expires_at": "2026-06-09T12:00:00.000Z",
    "remaining_hours": 71,
    "source": "artifact.collection_updated_at"
  }
}

Send the url to your reviewer.

What the reviewer sees

The public page renders:

verification status
signing key ID
runtime ID
SHA-256 digest
artifact list
link expiry time

Opening the page records an evidence_verified product event when signed evidence is present.

Retain a local copy

A share link is not a substitute for retaining the evidence bundle. Download the bundle and manifest before the retention window closes. Supply RID and an existing TACHYONIC_API_KEY through the process environment. Keep temporary download URLs out of arguments and logs. This example caps each artifact at 16 MiB:

import json
import os
from pathlib import Path
from urllib.request import Request, urlopen

rid = os.environ["RID"]
destination = Path("tachyonic-evidence") / rid
destination.mkdir(parents=True, exist_ok=True)
request = Request(
    "https://api.tachyonic.sh/api/v1/runtimes/" + rid + "/artifacts?limit=100",
    headers={"x-api-key": os.environ["TACHYONIC_API_KEY"]},
)
try:
    with urlopen(request, timeout=30) as response:
        artifacts = json.load(response)["data"]
    for artifact in artifacts:
        if artifact["type"] not in ("finding_bundle_v1", "evidence_manifest_v1"):
            continue
        name = artifact["filename"]
        if Path(name).name != name or name in ("", ".", ".."):
            raise ValueError("invalid artifact filename")
        with urlopen(artifact["url"], timeout=30) as response:
            content = response.read(16 * 1024 * 1024 + 1)
        if len(content) > 16 * 1024 * 1024:
            raise ValueError("artifact exceeds example limit")
        (destination / name).write_bytes(content)
except Exception:
    raise SystemExit("Evidence download failed") from None

tachyonic verify "tachyonic-evidence/$RID"

Current boundaries

Share links are for signed evidence review. They are not supply-chain provenance, hosted signing identity, structured runtime attestation, or a legal conclusion. Structured runtime attestation is planned for Phase B.