Portable evidence contract
A DetCordon evidence bundle is a portable, offline-verifiable handoff from one reviewed run. It carries redacted event metadata, encrypted sample artifacts, configuration digests, custody information, checksums, and a detached signature. A reviewer does not need access to the DetCordon repository or the sink host to validate the bundle.
Integrity model
- The sink computes the sample SHA-256 digest rather than trusting a client
- Samples remain age-encrypted and are referenced by content digest.
- A canonical manifest records the time window, source identity, component and
- Checksums cover every shipped file and reject unlisted additions, removals,
- The detached SSHSIG covers canonical manifest data under a dedicated
- Verification uses a signer key obtained through a separate trusted channel,
declaration.
configuration provenance, event digests, encrypted-artifact digests, and custody lineage.
or changes.
namespace.
never a key supplied only inside the bundle.
Disclosure boundary
Public and buyer-facing bundles must not contain raw or decrypted sample bodies, private keys, environment files, credentials, unrestricted request headers, or operator-local absolute paths. Failed verification is a failed handoff; consumers must not silently accept partial integrity.
The full schema, synthetic fixture, verifier, and tamper-detection transcript are available during qualified diligence.