Audit-Ready Evidence Templates

# Audit-Ready Evidence Templates
Layer: Certification
Status: Normative
Audience: Auditors, incident leads, certification bodies
## Executive Summary
An audit fails when evidence is narrative.
An audit succeeds when evidence is structured, replayable, and machine-diffable.
This document defines standard evidence artifacts for seal incidents, parity runs, merge events, refusal events, and ledger snapshots.
## Universal Evidence Header
Every artifact begins with:
```yaml
evidence_type: <seal_incident | parity_run | merge_event | refusal_event | ledger_snapshot>
artifact_version: 1
run_id: <uuid>
generated_at: <UTC ISO-8601>
operator_id: <id or automated harness>
bundle_sha256: <hash>

Seal Incident Report

incident_class: <A|B|C|D|E>
slug: <document slug>
rev_slug: <revision slug>
expected_hash: <hash>
observed_hash: <hash>
replay_result:
  match: true|false
  replay_hash: <hash>
classification:
  root_cause: <encoding|drift|fork|tamper|unknown>
  confidence: <low|medium|high>
action_taken:
  system_frozen: true|false
  nodes_isolated: true|false
  escalation_level: <none|internal|external>

Parity Wargame Result

mode: <replay|drift|fork|adversarial>
fixture_bundle: <bundle id>
summary:
  total_docs: <n>
  matches: <n>
  mismatches: <n>
  refusals: <n>
pass: true|false

Merge Arbitration Record

event_type: merge_arbitration
fork_origin: <timestamp or rev id>
branch_a_head: <rev_slug>
branch_b_head: <rev_slug>
decision:
  selected_branch: <a|b|refuse>
  doctrine_applied: <merge rule id>
resulting_head: <rev_slug or null>

Refusal Event

event_type: refusal
node_id: <identifier>
slug: <slug>
rev_slug: <rev>
reason_code: <canonical refusal code>
majority_state_hash: <hash>
local_state_hash: <hash>
escalated: true|false

Storage Rules

Evidence artifacts must be:

* append-only
* immutable
* content-addressed
* versioned
* redundantly stored

Deleting evidence is treated as a tamper event.

Final Principle

Evidence is not documentation.

Evidence is a measurement.

A measurement that cannot be replayed is not evidence.