Audit bundle

audit output evidence

Operator-downloadable .zip containing verifier + workspace identity + chain metadata + framework handoff.

What it is

The audit bundle is a zip download from the workspace dashboard. Contents: verify.mjs (the Apache-2.0 verifier), workspace.json (workspace id + signing public key + chain heads + tier), recent-receipts.jsonl + .csv (last-100 receipt metadata cache), anchor-history.jsonl (signed chain-head observations), README.md (instructions for the regulator).

The bundle equips a regulator to verify a chain air-gapped. The chain itself comes from the operator's separate export (workspaces with millions of entries don't fit in a bundle; the bundle is the verification harness, the chain is supplied separately).

On Enterprise tier, the bundle additionally includes framework handoff packets — per-framework Markdown documents mapping each regulation's articles to the substrate's evidence kinds, with an explicit 'operator must also' gap statement for each.

What it guarantees

Self-contained verification — no Promethean infrastructure access required.
Cryptographic chain of trust from workspace identity through signing key through entries.
Apache-2.0 verifier in the bundle — regulators can read, fork, re-implement.

What it does NOT guarantee

Honest limits. Every primitive has them.

That the operator hasn't withheld entries — the chain export is the operator's responsibility.
Substantive compliance with any regulation — the bundle is the verification harness; conformity is operator's.

Regulations that engage this kind

All frameworks Promethean covers (7 templates)

GDPR + EU AI Act + PSD3+PSR + DORA + NIS2 + MDR + HIPAA

Sectors that rely on this kind

Related evidence kinds

L12 receipt chain

Hash-chained, Ed25519-signed log of every LLM-in-the-loop decision a Promethean-built product makes.

Ed25519 attestation

Per-entry Ed25519 signature using the operator's workspace signing key.

FAQ

Does the bundle contain the chain itself?

Only a metadata cache (last 100 receipts). For full verification, the operator exports the full chain separately. Reason: chains can be very large (millions of entries / GB-scale JSONL); putting the bundle in a download workflow doesn't scale.

What's the verifier doing inside the bundle?

verify.mjs is ~500 lines of Node stdlib code. It re-hashes each entry per the canonical form, verifies the Ed25519 signature per entry, walks the prevHash chain, checks monotonic timestamp ordering, validates the OpenTimestamps anchor proofs, optionally scopes to a specific tenant. Exit code 0 = chain integrity verified.