LEAKTRACE EVIDENCE PACKAGE
==========================

Customer:      Harbourview Law LLP
Domain:        harbourview-llp.example
Report ID:     LT-BIZ-2026-7098
Scan ID:       00000000-0000-0000-0000-000000000004
Scanned at:    2026-09-15T20:43:20Z
Generated at:  2026-10-17T00:20:04Z
Signed at:     2026-10-17T00:20:04Z
Signed by:     LeakTrace Inc.

CONTENTS
--------
  evidence_package.pdf   Auditor-ready PDF: every finding with observed
                         output, reproduction command, methodology
                         citation, and remediation timeline. Cover page
                         carries scan ID, customer name, domain, and
                         generation timestamp.

  evidence_package.json  Same data in machine-readable JSON for compliance
                         tooling and GRC platforms. Schema version 1.
                         Top-level keys: customer, scan, summary, findings,
                         methodology, integrity.

  README.txt             This file.

INTEGRITY VERIFICATION
----------------------
Every finding carries a per-evidence integrity hash inside its
`evidence.integrity` block. Every lifecycle event carries an
`integrity_hash` and a Merkle-style `chain_hash` linking it to all
prior events on the same finding — modifying any earlier event
breaks every chain hash that follows it.

To verify this Evidence Package was not modified after signing:

  1. PDF — direct hash:
       sha256sum evidence_package.pdf
       expect: d31ffdb4c0077d2e96fb40b8eb966ce84b884ee66a1eb54e221ccf4b65712607

  2. JSON — self-referential hash (the JSON file contains its own
     hash, so the verifier substitutes a placeholder before re-hashing):
       a. Parse evidence_package.json
       b. Set integrity.json_sha256 to "" (empty string)
       c. Re-serialise with sort_keys=True, indent=2,
          ensure_ascii=False (matches how this file was produced)
       d. SHA-256 the resulting bytes
       expect: 2085f009d901efeda8a8c9b6a5149e163a81cf46d88d4570bf5b1214912d1faf

     Reference Python (3.7+):
       import json, hashlib
       d = json.load(open("evidence_package.json"))
       d["integrity"]["json_sha256"] = ""
       b = json.dumps(d, sort_keys=True, indent=2,
                      ensure_ascii=False).encode("utf-8")
       print(hashlib.sha256(b).hexdigest())

  3. Per-finding evidence — recompute and compare:
       For each finding f in evidence_package.json["findings"]:
         payload = {k: str(f["evidence"].get(k) or "")
                    for k in ("raw_output", "reproduction_command",
                              "methodology", "observed_at")}
         h = hashlib.sha256(json.dumps(payload, sort_keys=True,
             ensure_ascii=False, separators=(",",":")
             ).encode("utf-8")).hexdigest()
         assert h == f["evidence"]["integrity"]["hash"]

  4. Lifecycle chain — walk forward from the first event:
       prev_chain = ""
       for ev in finding["lifecycle_events"]:  # ordered by created_at
         expected = ev["integrity_hash"] if not prev_chain else \
             hashlib.sha256((prev_chain + ev["integrity_hash"]
                            ).encode("utf-8")).hexdigest()
         assert expected == ev["chain_hash"]
         prev_chain = ev["chain_hash"]

A non-matching hash means the corresponding artifact was modified
after signing. Contact info@getleaktrace.com to obtain a fresh
signed copy of the package directly from our infrastructure.

METHODOLOGY
-----------
All findings are derived from passive reconnaissance of public-facing
infrastructure and breach-database correlation. No private systems were
accessed. Each infrastructure finding includes a reproduction command
the auditor can run independently to verify the observed output.

DETERMINISM
-----------
For a given scan state, the bytes of evidence_package.pdf and
evidence_package.json are deterministic. Findings are sorted by
(severity rank, finding_key, title); lifecycle events by created_at.
No random IDs or wall-clock dependencies inside the documents.

CONTACT
-------
Questions about this evidence package, or to request additional
reproduction transcripts, contact info@getleaktrace.com and
reference Report ID LT-BIZ-2026-7098.

LeakTrace Inc..
