Evidence Package Anatomy

Evidence Package Anatomy

Authority: Operational navigation; schemas are canonical
Applies to: Evidence packages produced by the installed release
Last reviewed: 2026-07-19
Maintainer: @mikeholownych

An evidence package normally contains a manifest, findings, report projection, captured inputs, observations, output artifacts, and checksums. Exact fields are defined by the released schemas.

Review in this order:

1. manifest.json: command, tool version, target, assumptions, status, and incomplete checks.
2. checksums.json: preservation integrity for package artifacts.
3. findings.json or observations/: individual technical states.
4. Raw captures: what the collector actually received.
5. report.md or projections: human-readable views, never alternate authority.

A checksum protects captured bytes after collection. It does not prove source authenticity, completeness, or representativeness.