AWS Evidence
Evidence manifest
The record of what every collector actually did during a run, written whatever the outcome, and read by the engine to report coverage honestly.
What it is
A file written during every run capturing each collector's outcome, the scan scope, the account, and a note that the assessment was read-only.
Why it is written unconditionally
It is written even on runs that failed. A manifest that only exists on success cannot explain a failure, which is the case it is most needed for.
How GovIntel applies it
The engine reads it and derives each collector's reported state from it. That is what turns "the resilience domain was not scored" into the more useful "the resilience collector was denied a permission".
What it does not mean
The manifest records what happened to the collectors. It is not the evidence, and it does not say whether a domain was rated.