Evidence bundles

An evidence bundle is a signed archive that proves what happened in a run or date range — and proves it without depending on Orkena being available, online, or in business.

What’s in a bundle#

Component	Purpose
Ledger slice	All events in the requested scope, hash-chained
Anchors	All Ed25519 signatures covering the slice
Public key	The Orkena public key for anchor verification
Report	A readable HTML summary of what happened
verify.py	The dependency-free verification script

How it is signed#

The ledger slice is hash-chained per event — see The hash-chained ledger for the structure. The chain head is signed periodically with an Ed25519 anchor. The anchor’s public key travels inside the bundle, so verification needs nothing from Orkena.

How to verify#

On any machine with Python (standard library only):

python verify.py bundle.zip

chain: 417 events verified · anchors: 3 signatures valid
RESULT: OK

Tamper with a single byte and the verifier catches it:

RESULT: FAILED — hash mismatch at SEQ 0212
  expected: 8c3155…a09d
  actual:   ab19f2…3e77

Why offline verification matters#

Your auditor does not call an API, check a status page, or open a support ticket. The verifier runs on a fresh machine with no network access and returns a byte-level answer. That is the difference between evidence and a report about evidence.

Retention#

Bundles are yours permanently. Export at any time; store them per your retention policy. Hard-delete of tenant data never touches the bundles you already hold — they are self-contained.

Export#

See Export an evidence bundle for auditors for the walkthrough.