# Evidence Pack — how to verify this yourself

Generated: 2026-08-04T09:00:00.000Z
Evidren version: 0.6.1
Pack format: signat-evidence-pack/v0 (the identifier predates the rename from Signat and is kept unchanged)
Audit lines: 4
Lines Evidren could not read: 0
Integrity at export: chain VERIFIED
manifest.json sha256: `57bebee63d5094084ee2039f45a98300204a71b6b398ed46edbf6e1320e1996a`
VERIFY.md sha256, computed with this value as 64 zeros: `254c277c66abaff056bcb8162668dc138eed2064fb1060e56460f60f1c8df883`

## What this pack is

A byte-for-byte export of an Evidren install's tamper-evident record: every action
an AI agent took that was routed through Evidren, the decision Evidren made, and
the policy that was in force. Payloads were masked when they were recorded
(secrets are represented by keyed references, never plaintext).

## Verify it WITHOUT trusting Evidren

The hash chain is plain sha256 over raw lines, so any tool can check it. Each
line's `prevHash` is the sha256 of the previous line's exact bytes; the first
line's is 64 zeros. No parser is required — the digests are fixed-length hex in
a known position, so `sed` reaches them. Every line starts
`{"v":1,"prevHash":"…"`, and the recipe reads the digest only there: a
recorded payload can hold a key of the same name further on.

Nothing below needs Evidren, a runtime, or a network. It is POSIX shell plus
`shasum` — deliberately, so that "you can check this yourself" is not a claim
that quietly depends on us shipping you a tool.

```sh
# 1. Re-link the chain. Prints the line count, or the first line that fails.
prev=$(printf '0%.0s' $(seq 64))
n=0
while IFS= read -r line; do
  n=$((n+1))
  got=$(printf '%s' "$line" | sed -n 's/^{"v":[0-9]*,"prevHash":"\([0-9a-f]\{64\}\)".*/\1/p')
  [ "$got" = "$prev" ] || { echo "BROKEN at line $n"; break; }
  prev=$(printf '%s' "$line" | shasum -a 256 | cut -d' ' -f1)
done < audit.jsonl
echo "checked $n lines"

# 2. The sealed head must be the sha256 of the last line — this is what makes
#    truncating the tail detectable.
tail -n 1 audit.jsonl | tr -d '\n' | shasum -a 256 | cut -d' ' -f1
sed -n 's/.*"headHash":"\([0-9a-f]*\)".*/\1/p' chain-head.json

# 3. Every file in this pack must match its digest in the manifest.
shasum -a 256 audit.jsonl chain-head.json policy.json summary.json
cat manifest.json     # compare against the "files" digests
```

## What this pack PROVES

- The exported history is internally consistent: no line was edited, inserted,
  or reordered after it was written. Any such change breaks the chain at a
  specific, identifiable line.
- Which policy was in force at export, so the decisions can be re-derived.
- That secret redaction ran, via keyed references — without exposing a secret.

## What this pack does NOT prove — read this before relying on it

1. **It cannot prove nothing was destroyed before export.** The D18 tail seal
   (`chain-head.json`) is an HMAC under this install's redaction key. That key
   never leaves the machine, so *you cannot verify the seal from this pack* —
   only the holder can. An attacker with local write access who deletes the log
   AND the seal leaves an install that looks new. The record is tamper-EVIDENT,
   not tamper-PROOF. Closing this needs an external anchor (a counter-signed
   remote receipt), which is roadmap, not shipped.
2. **It only contains what was routed through Evidren.** Actions taken outside a
   covered surface — no hook installed, a tool Evidren does not sit in front of,
   a shell opened directly by a human — were never recorded and are absent here.
   Absence of an entry is not evidence the action did not happen.
3. **Coverage equals the ruleset.** The shipped default is `onUnmatched: allow`:
   Evidren records everything it sees but only BLOCKS what its rules recognize.
   An `allow` in this log means "no rule matched", not "reviewed and judged
   safe". See `shadow-report.json` for what a stricter policy would have caught.

## Regulatory mapping — deliberately NOT asserted

This pack makes no claim about ISO/IEC 42001 or EU AI Act Article 12/26
conformity. The facts below are what the pack contains; which control, if any,
each fact serves is a judgement that requires an accredited auditor's input, and
inventing it here would be a fabricated claim. The right-hand column is left for
a human to complete after that grounding exists.

| Fact this pack contains | Control it serves |
|---|---|
| Chronological record of automated decisions, with timestamps | *(unmapped — pending auditor input)* |
| Cryptographic integrity proof over that record | *(unmapped — pending auditor input)* |
| The decision policy in force during the period | *(unmapped — pending auditor input)* |
| Evidence that secrets were masked before storage | *(unmapped — pending auditor input)* |
| Counterfactual: what a stricter policy would have stopped | *(unmapped — pending auditor input)* |