Your spans are testimony. Subpoena the witness.

Exhibit A · the invariant

One string. Three courts.

An invariant is a TraceQL query, and any trace that matches it is a violation. This one says a session that was denied must never go on to execute anything:

invariants/no_exec_after_deny.traceql{ name = "agent.session.authorize" && span.authorization.allowed = false }
  >> { name = "agent.session.exec" }

The same file is evaluated in-process by your unit tests, against a real collector and Tempo in integration, and as a Grafana alert rule in production. Promoting it between tiers is a copy and paste, and a test checks that the copies still match.

Exhibit B · testimony vs. proof

The code that enforces a policy also reports enforcing it.

If the deny check breaks, the span saying "denied" can break along with it. Asserting on spans alone asks the defendant whether they did it.

examples/gateway/gateway_test.go// (c) the invariant returns zero traces.
harness.RequireAbsent(t, tr, invariants.MustLoad(invariants.NoExecAfterDeny))

// (e) the independent witness saw zero spawned processes for this trace.
if spawned := r.w.Spawned(ids[0]); len(spawned) != 0 {
	t.Fatalf("witness saw processes after a denial: %+v", spawned)
}

Absence is the hard case. "We saw nothing" proves nothing if the capture was incomplete, so absence assertions return Pass, Fail or Inconclusive, and Inconclusive fails by default.

Exhibit C · cross-examination

Prove the suite can tell the difference.

Functions marked //subpoena:enforcement_point get cross-examined: subpoena-cross removes each enforcement statement and reruns the suite. If the tests still pass, they weren't testing enforcement.

Authorization code has been mutation-tested before (AutoMutSec). The difference here is that the mutant leaves the record intact: the authorize span still says allowed = false while the action goes through. A suite that only checks the decision span stays green.

$ go run ./cmd/subpoena-cross ./examples/gateway
baseline: go test ./examples/gateway/...
mutant: Authorize (examples/gateway/gateway.go:145) removed "return ctx, fmt.Errorf(...ErrDenied...)"
enforcement-mutant-killed Authorize
  suite went red; failing: TestDeniedSessionCgroupStaysEmpty,
    TestDeniedSessionNeverExecs, TestHTTPDenyIs403AndSpawnsNothing

The rest of the rules are the repository's AGENTS.md, the instructions coding agents read before they touch the code, and subpoena-lint checks each one on every change. An agent working in the codebase inherits them rather than being trusted to remember them. The lint checks that the markers and calls are there, not that they're honest; cross-examination is what tests the tests.

1. No telemetry the registry doesn't know. A span name or attribute key that isn't in the registry is flagged; use the generated constants.
2. Collect before you assert. A test file that never calls Collect() is flagged, and so is an absence check with no Collect() before it.
3. Mark provenance. Each test file must declare spec_derived (written from the registry and docs) or impl_derived (written after reading the code).
4. Enforcement points need a witness. A function marked as enforcing policy is flagged unless some test asks the witness what actually happened.
5. Take the tracer from the harness. Code under test that builds or installs its own tracer provider is flagged: spans sent elsewhere make every absence check pass for the wrong reason.
6. The registry is the contract. A change set that touches the registry and the tests asserting on it is flagged for review, and CI blocks breaking changes without an approval label.

Exhibit D · the record

What runs today, and where it was checked.

Subpoena is in alpha and Go-only for now. Python and TypeScript are next, and the contract a port must meet, with a check for each part, already exists. The API will change before 1.0. Every kernel-level tier below (cgroups, the eBPF witness, OATS, the alert rules, Tempo conformance) runs in GitHub CI on every pull request.

The TraceQL evaluator is a documented subset rather than Tempo's engine, by design: Tempo is AGPL-3.0 and Subpoena is Apache-2.0. A conformance suite runs every fixture through both and requires identical verdicts.

Array attributes are refused, not guessed. We measured Tempo 2.8.2: one condition on an array means "some element matches", but combinations don't follow from that rule. So a query that reads an array attribute fails the test, rather than risk a tier-1 pass that tier 3 would contradict. The measurements are in the subset docs.

Exhibit E · the briefs

Read further.