Add evidence bundle export and verification capability #3

New Issue

2026-07-10T17:51:04+02:00

zemion commented

2026-07-10 17:51:04 +02:00

Core split follow-up from add-ideas/govoplan-core#99.

Evidence bundle export belongs to the audit module as a later audit capability, with module-owned storage references and redaction controls.

Acceptance criteria:

Define an audit evidence bundle DTO and export request/result lifecycle.
Include audit records, trace context, policy/source provenance references, module evidence references, and redaction metadata.
Do not embed secrets, raw message bodies, full recipient lists, or file contents directly in the bundle.
Add permission checks and audit records for evidence bundle generation/download.
Document how modules contribute evidence references without importing audit internals.

Verification extension

Moved from Core #136.

Produce a versioned manifest with canonical hashes and optional trusted signatures for every included record/reference.
Provide an offline verifier that validates schema, hashes, signatures, redaction declarations, and completeness without requiring access to the source database.
Report unsupported versions, missing external evidence, and unverifiable references distinctly from tampering.
Maintain compatibility fixtures for supported bundle versions and deterministic verification output suitable for independent evidence review.

Core split follow-up from add-ideas/govoplan-core#99. Evidence bundle export belongs to the audit module as a later audit capability, with module-owned storage references and redaction controls. Acceptance criteria: - Define an audit evidence bundle DTO and export request/result lifecycle. - Include audit records, trace context, policy/source provenance references, module evidence references, and redaction metadata. - Do not embed secrets, raw message bodies, full recipient lists, or file contents directly in the bundle. - Add permission checks and audit records for evidence bundle generation/download. - Document how modules contribute evidence references without importing audit internals. ## Verification extension Moved from [Core #136](https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/136). - Produce a versioned manifest with canonical hashes and optional trusted signatures for every included record/reference. - Provide an offline verifier that validates schema, hashes, signatures, redaction declarations, and completeness without requiring access to the source database. - Report unsupported versions, missing external evidence, and unverifiable references distinctly from tampering. - Maintain compatibility fixtures for supported bundle versions and deterministic verification output suitable for independent evidence review.

zemion referenced this issue from GovOPlaN/govoplan-core

2026-07-10 17:51:19 +02:00

[Feature] Add evidence bundle export as a later audit capability #99

zemion added the area/devex area/governance area/module-system codex/ready module/audit

labels 2026-07-29 14:15:10 +02:00

zemion changed title from ~~Add evidence bundle export capability~~ to Add evidence bundle export and verification capability

2026-07-31 01:22:06 +02:00

zemion commented

2026-07-31 01:22:07 +02:00

Core #136 has been folded into this issue as the independent verification half of evidence bundles. Source.

Core #136 has been folded into this issue as the independent verification half of evidence bundles. [Source](https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/136).

zemion referenced this issue from GovOPlaN/govoplan-core

2026-07-31 01:22:10 +02:00

[Task] Evidence bundle verifier #136

zemion referenced this issue from GovOPlaN/govoplan-campaign

2026-07-31 04:26:10 +02:00

[Feature] Add evidence bundle export and verifier #12

zemion commented

2026-07-31 04:26:11 +02:00

Campaign #12 has been folded into this issue as a source-module integration requirement: GovOPlaN/govoplan-campaign#12.

Campaign contributes bounded references for selected version, validation/build evidence, delivery jobs/results, retained EML state, Postbox delivery/read state, and report provenance through the generic evidence contribution contract. Audit owns bundle schema, export/download authorization, redaction, signatures, offline verification, and compatibility fixtures. No Campaign-specific bundle format or verifier should be introduced.

Campaign #12 has been folded into this issue as a source-module integration requirement: [GovOPlaN/govoplan-campaign#12](https://git.add-ideas.de/GovOPlaN/govoplan-campaign/issues/12). Campaign contributes bounded references for selected version, validation/build evidence, delivery jobs/results, retained EML state, Postbox delivery/read state, and report provenance through the generic evidence contribution contract. Audit owns bundle schema, export/download authorization, redaction, signatures, offline verification, and compatibility fixtures. No Campaign-specific bundle format or verifier should be introduced.

zemion commented

2026-08-20 18:18:55 +02:00

Implementation complete locally across Audit 7b43816, Core 604f20e, and workspace catalog d08f9f0.

Delivered:

persisted pending/ready/failed export lifecycle with bounded, exact record/reference selection and reauthorization for metadata/download;
module-owned tenant/system export permissions, role templates, and generation/download audit events;
deterministic versioned manifests with canonical per-item and overall hashes, trace/policy/source provenance, generic module evidence references, and strict redaction/rejection rules;
optional Ed25519 signing and an offline govoplan-audit-verify CLI with distinct valid/incomplete/unverifiable/tampered/invalid/unsupported outcomes;
supported-version compatibility fixture, administrator export UI, endpoint classification, manifest documentation, and system-scope compatibility handling in Core.

Verification: 22 Audit tests and 128 Core module-system tests (255 subtests) passed; migration, lint, TypeScript, manifest/inventory/interface checks, verifier fixture, and the complete workspace focused gate passed.

The issue remains open only until the local commits are pushed.

Implementation complete locally across Audit `7b43816`, Core `604f20e`, and workspace catalog `d08f9f0`. Delivered: - persisted pending/ready/failed export lifecycle with bounded, exact record/reference selection and reauthorization for metadata/download; - module-owned tenant/system export permissions, role templates, and generation/download audit events; - deterministic versioned manifests with canonical per-item and overall hashes, trace/policy/source provenance, generic module evidence references, and strict redaction/rejection rules; - optional Ed25519 signing and an offline `govoplan-audit-verify` CLI with distinct valid/incomplete/unverifiable/tampered/invalid/unsupported outcomes; - supported-version compatibility fixture, administrator export UI, endpoint classification, manifest documentation, and system-scope compatibility handling in Core. Verification: 22 Audit tests and 128 Core module-system tests (255 subtests) passed; migration, lint, TypeScript, manifest/inventory/interface checks, verifier fixture, and the complete workspace focused gate passed. The issue remains open only until the local commits are pushed.

zemion commented

2026-08-20 19:11:53 +02:00

Published and verified on remote main: Audit 7b43816, Core 604f20e, workspace d08f9f0. The repository has no configured commit-status contexts/workflow files; the recorded complete focused workspace gate is the integration evidence. Acceptance criteria are satisfied, so this issue is being closed.

Published and verified on remote `main`: Audit 7b43816, Core 604f20e, workspace d08f9f0. The repository has no configured commit-status contexts/workflow files; the recorded complete focused workspace gate is the integration evidence. Acceptance criteria are satisfied, so this issue is being closed.

zemion closed this issue

2026-08-20 19:11:53 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-audit#3