Audit and incident handoff

Evidence a reviewer can retain, without a copy of your systems.

Give a customer, security reviewer, auditor, or partner evidence it can verify outside the system that produced it. Package selected records and native artifacts into a bounded, portable case.

evidence-bundleillustrative export
Case
ref DSP-2026-0417
Records
4 supplied
Artifacts
2 references
Missing
delivery observation
Case digest
sha256:6f0a3c...
records require individual verification
Signed recordsNative artifactsIntegrity digestsOffline verification
The problem

A screen recording is not something a reviewer can check.

An audit, a security incident, or a partner review usually asks the same question: can you show us what happened without giving us access to your systems? A signed record answers the questions that cross the boundary:

  • Which records and artifacts are relevant to the reviewed action or incident?
  • What dispute or review reference was the bundle assembled for?
  • Is the bundle complete and unaltered since it was assembled?
  • Can a reviewer check the signatures against a key they were told to expect?
  • What does the bundle not establish about the underlying incident?
The specimen

One dispute. One bounded bundle.

Create the bundle
{
  "case_ref": "DSP-2026-0417",
  "records": 4,
  "artifacts": 2,
  "missing": ["delivery_observation"]
}

Select the relevant signed records, native artifacts, issuer-key information, and review reference. Originary's pilot defines and implements this export for the selected workflow.

Verify the included records, offline by default
npx -y @peac/cli@0.16.3 verify \
  ./records/gateway-decision.jws \
  --public-key ./jwks.json

Each supplied record is verified independently, with the public key or JWKS the reviewer was told to expect. Case-level completeness and evidence sufficiency are assessed separately. Nothing is uploaded to Originary.

The reviewer verifies against a key you were told to expect.

What it contains

A handoff bundle, not a copy of your systems.

  • The signed records relevant to the reviewed action or incident.
  • Native artifacts or references the records point to.
  • The dispute or review reference the bundle was assembled for.
  • A verification report, generated at assembly time.
  • An integrity digest over the exported bundle contents.
Boundaries

What Originary does not do here.

  • It does not run your audit or incident-response process.
  • It does not decide what should have been recorded.
  • It does not store the bundle or the records inside it.
  • It does not require your reviewer to have an Originary account.
  • It does not need your raw logs.

It gives your review or dispute process a portable, independently verifiable bundle.

Hand off one bundle the next time a reviewer asks.

Start with the review or dispute another party already asked about. We will show what the bundle should contain.

Logs stay local. Signed records travel.