Evidence Pack
The artefact you hand a regulator. Assembled in seconds, signed by default.
1 · Read from ledger
Every event canonical-JSON serialised · SHA-256 chained to prior · Merkle root checkpointed daily into S3 Object Lock.
2 · Deterministic composer
Reads the campaign's frozen graph snapshot · assembles versions · approvers · disclosures · model traces · activation logs.
3 · Sign with KMS
ECDSA P-384 over the canonical JSON-LD · signing key in AWS KMS, FIPS 140-2 · dedicated AWS account · least blast radius.
Three signed formats · open JSON-LD spec · any auditor can verify
Regulator-facing
JSON-LD
Machine-readable · open spec
Word / redline
Outside counsel
What it is
What used to take 8–20 hours takes seconds. The Evidence Pack assembles every artefact version, every approver, every disclosure applied, every model invocation, every policy-pack version in scope, and every activation log into a single cryptographically signed regulator-ready package PDF + machine-readable JSON-LD + Word/redline for outside counsel.
A deterministic document assembler that reads from the cryptographic ledger and the campaign's frozen graph snapshot. Output is signed with an AWS KMS-backed ECDSA P-384 key; the signature, the canonical-body serialisation rules, and the verification protocol are published as an open spec so any auditor can verify independently.
Capabilities
What this surface does
One-click assembly
Versions · approvers · disclosures · model traces · pack versions · activation logs. Composed in under a minute for campaigns with up to 500 artefact nodes.
Cryptographic signature
ECDSA P-384 over canonical JSON-LD. Signing key in AWS KMS, FIPS 140-2 backed, in a dedicated AWS account with least-blast-radius access.
Hash-chained ledger source-of-truth
Every action serialises as a canonical event with SHA-256 hash chained to the prior event. Daily Merkle-root checkpoints into S3 Object Lock tamper evidence even against full-rights DB admins.
Three formats
Regulator-facing PDF · machine-readable JSON-LD · Word/redline for outside counsel.
Open specification
EvidencePack.json v1 published at evidencepack.org with a Python reference validator and a conformance test suite. For contribution to IAB Tech Lab and C2PA working groups goal is recognition as standard, not assertion.
Campaign freeze + version lock
On export, the exact graph state is locked. Later requests get the version that actually shipped not today's edit.
Proof points
What this means in numbers
< 1 min
Assembly latency
P95 for a 500-node campaign.
ECDSA P-384
KMS-backed signature
Verifiable independently by any auditor.
Open spec
Published v0.1
evidencepack.org · reference validator · conformance suite.
Specifications
Spec map feature requirements + non-functional bar
Mapped to PRD §7 functional requirements and §8 non-functional requirements.
Related surfaces
What this composes with
PS1 the moat primitive
Artefact Graph
Versioned, signed, cross-vendor the system of record for every campaign object.
Read
PS2 compliance-as-code
Policy Engine
Compliance-as-code for every live jurisdiction enforced at draft time.
Read
PS7 stack-neutral export bundle
Integrations
Native into Salesforce and Adobe. Ingest from Canva, Figma, Workfront, agencies. Bind it all.
Read
EU AI Act Article 50
Twenty minutes. One conversation. If the outside-counsel-displacement math works, we keep talking. If it doesn't, it's honest and short.