The answer appears when the run reaches it.
The answer is a signed record (Ed25519). A signature shows the bytes are unchanged since signing, not that they are true. Check it yourself.
What the run did, in order, with its own timing.
Before sending anything, Tinfoil's SDK checked the model router enclave's attestation.
ATTESTATION FACTS
Recorded at run time
This is the verification document Tinfoil's SDK produced when the recorded run connected. The Verification Center shows that document. It is not a live check.
The evidence behind the verify buttons.
The verify link opens typedstandards.org's verifier, which fetches the signed bundle from this site and checks it in your browser.
The container ran the whole chain in a hardware enclave and signed with a key it generated. That key is published in the container's attestation.