Update from code changes: attestation proof enforcement + trust gate

[mintlify]

Summary

Document the mandatory-proof enforcement on VERIFIED attestations and the new enforce_trust_decision() trust-boundary entry point shipped in qwed-verification#248.

Changes

• advanced/attestations.mdx: added VERIFIED_WITHOUT_PROOF to the fail-closed contract (error code + status table + issuance-side subsection), and a new Enforce the trust boundary section covering enforce_trust_decision() parameters, claims binding, and the fail-closed matrix.
• changelog.mdx: new top-level entry describing both the issuance rule and the consumption-side gate, with before/after snippets and rollout guidance.

Context

Two sides of one boundary shipped together: the crypto layer now refuses to sign a VERIFIED result without proof_data, and every release gate is expected to route through enforce_trust_decision() so the attestation JWT is bound to the result (status, query hash, proof hash) before admission.

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

[qwed-security]

QWED Security Verification Report

2 files scanned | 0 blocked | 0 warnings | 0 info | 0 suppressed | 2 verified

Engines

• entropy_scan: ✅
• pattern_scan: ✅

Verified Files

• advanced/attestations.mdx
• changelog.mdx

---

Verified by QWED — deterministic security verification. No LLM used.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
qwed-ai	🟢 Ready	View Preview	Jul 28, 2026, 4:15 AM

[greptile-apps]

Greptile Summary

Documents the newly shipped attestation proof and trust-boundary enforcement.

• Adds the VERIFIED_WITHOUT_PROOF issuance failure contract and proof-bearing example.
• Documents enforce_trust_decision(), claim binding, policy modes, and fail-closed outcomes.
• Adds rollout guidance and before/after examples to the changelog.

Confidence Score: 4/5

The documentation needs a small fix before merging because its primary proof-bearing issuance example cannot run as written.

The newly added proof_data=json.dumps(evidence, sort_keys=True) expression references an unimported module and an undefined evidence value, so Python fails before reaching the documented API.

Files Needing Attention: advanced/attestations.mdx

Important Files Changed

Filename	Overview
advanced/attestations.mdx	Adds proof-enforcement and trust-gate reference material, but the updated issuance example fails because its new proof expression uses undefined names.
changelog.mdx	Adds release notes, migration examples, telemetry guidance, and links for the attestation enforcement rollout.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Engine result] --> B{Status is VERIFIED?}
    B -- No --> C[Pass through fail-closed status]
    B -- Yes --> D{Proof supplied at issuance?}
    D -- No --> E[BLOCKED: VERIFIED_WITHOUT_PROOF]
    D -- Yes --> F[Issue attestation JWT]
    F --> G[enforce_trust_decision]
    G --> H{Token valid and claims bound?}
    H -- No --> I[BLOCKED]
    H -- Yes --> J[Admit VERIFIED result]

Loading

_{Reviews (1): Last reviewed commit: "docs: document VERIFIED_WITHOUT_PROOF an..." | Re-trigger Greptile}

[greptile-apps]

Undefined proof example inputs

When a reader runs this issuance example, json.dumps(evidence, sort_keys=True) references both an unimported module and an undefined evidence value, causing NameError before create_verification_attestation() is called.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
qwed-ai	🟡 Building	–	Jul 28, 2026, 4:14 AM