A stable identity
A content-hash ID identifies the fact. Its identity includes the tenant, entity, data window, measurements and method version. Receipt updates do not change that identity.
THE EVIDENCE ENGINE
Evidence your team
and your agents can check.
Epok ingests your logs, metrics, traces and real-user data and turns them into evidence with receipts. Your on-call team and your AI agents use the same facts to recognize incidents, investigate root causes, assess recovery and forecast trouble.
An evidence item tells you what was observed, where it came from, and what the data does not establish. Follow its receipts to the source records. Check its coverage before drawing a conclusion.
Inside an evidence item
A precise observation
Typed entities, decimal values and explicit units make the item interpretable. Unresolved entities stay visible. An observation says what was measured; causal claims belong to analysis and must cite supporting evidence.
Receipts you can follow
Receipts record the query, detector inputs or source-record reference behind a finding. Query receipts retain the exact query internally; agents receive an opaque query reference and redacted description, then bounded access to retained records.
Coverage you can question
Each item states its result and completeness. A partial window, missing input or query that did not run stays visible alongside the finding.
Illustrative JSON excerpt from the gateway's compact schema-v2 projection, using synthetic data. The measured value is an example, not a benchmark result. The full item also carries method, timing and display-limit metadata; get_item supplies detailed receipts and drill handles.
The ⟨untrusted:…⟩ placeholders in the example statement mark log and metric text as untrusted so agents treat it as data, not instructions.
Illustrative evidence item · synthetic data
json
{
"id": "ev_a958339e1a53851e11be91a8fb1b1b9d",
"schema_version": "2",
"kind": "observation",
"statement": "⟨untrusted:metric⟩ measured 1.000 ms for ⟨untrusted:entity⟩.",
"window": {
"start": "2026-01-01T00:01:00Z",
"end": "2026-01-01T00:02:00Z"
},
"resolved": true,
"untrusted_text": {
"metric": "<untrusted_text>latency</untrusted_text>",
"entity": "<untrusted_text>checkout</untrusted_text>",
"entity_type": "<untrusted_text>service</untrusted_text>",
"method": "<untrusted_text>fixture@1</untrusted_text>"
},
"values": [
{
"untrusted_text": "<untrusted_text>current</untrusted_text>",
"value": "1.000",
"unit": "ms"
}
],
"coverage": {
"result": "found",
"completeness": "complete",
"reason": null
},
"receipts": [
{
"receipt_level": "detector_summary",
"query_ref": "qr_48b5a5636b8070d1",
"window": {
"start": "2026-01-01T00:01:00Z",
"end": "2026-01-01T00:02:00Z"
},
"inputs_captured": true
}
]
}COVERAGE
What we saw. What we did not see.
| Result | Meaning |
|---|---|
found | The check found matching evidence in the inspected data. |
none | None in retained data for this scope. This does not prove that nothing happened. |
not_run | The check did not complete or was not attempted. A reason records the gap; this is not a negative finding. |
Completeness is separate: complete, partial, sampled, stale, unavailable or unknown. Missing traces, expired raw records and checks that did not run remain limits on the conclusion. A pack also reports evidence left out by its response budget.
AGENT ACCESS · MCP
Ask for evidence. Follow the receipts.
Claude Code, Codex and other MCP clients use list_entities to find services, get_evidence to read a bounded pack, get_item to inspect a finding, and drill to read its retained source records. The gateway preserves the facts and their deterministic order.
Compact evidence reduces the raw material an agent has to read repeatedly. Budgets, paging and bounded drill-downs control context use. API keys isolate accounts and projects. Log lines and other telemetry text are scrubbed, delimited and marked untrusted_text, so agents can treat them as data rather than instructions. Agents must still respect that boundary.
OWNED INGEST
The evidence starts in Epok's pipeline.
Send telemetry directly to Epok through OpenTelemetry and supported shippers. Detectors and evidence producers work on that ingested data. Analysis groups incidents, evaluates causes, recommends recovery from change and blast radius, and forecasts forming failures. The app, Slack, PagerDuty and MCP bring that evidence to your team and agents.
We recommend; you execute. Recovery recommendations give responders a reversible action to assess while the investigation continues.