The evidentiary spine: write-once originals, provenance, an append-only hash-chained log, audit workpapers and exportable legal packages. The same Evidence Core is intended to serve other BB2G domains, which is what makes it a platform rather than a page.
29
Evidence Vault
Immutable originals, hashes, classifications, metadata, custody, legal holds, access history, controlled previews and exports.
Constraint. Permission attaches to the value, not to the page: a classified item stays classified through every derivative, preview and export.
Workflows, objects, events, acceptance
- Purpose
- Store originals immutably with hashes, classification and custody, and control every preview, export and access against them.
- Workflows
- Ingest an original, hash it, and write it once
- Classify the item and attach metadata and custody
- Place and release legal holds
- Serve a controlled preview or derivative without releasing the original
- Log every access with identity and purpose, and export under approval
- Primary objects
EvidenceItem EvidenceHash Classification LegalHold AccessRecord
- Domain events
EVIDENCE_INGESTED EVIDENCE_CLASSIFIED LEGAL_HOLD_PLACED EVIDENCE_ACCESS_LOGGED EVIDENCE_EXPORTED
- Acceptance gate
- Originals are write-once with no update path, a legal hold blocks deletion in code, classification drives permission, every access is logged, and re-hashing any stored original reproduces its recorded hash.
- Role surfaces
- manager · county · state
lockchainevidenceidentityjurisdictionreportingobservability
30
Immutable Audit Log
Append-only canonical events, hash chain, signed checkpoints, key rotation, independent verification and tamper alerts.
Constraint. Describe this publicly as tamper-evident, never as magically immutable. A privileged attacker holding every database, key, checkpoint and backup could fabricate a replacement history, which is exactly why keys, checkpoints and backups are separated and independently verifiable.
Workflows, objects, events, acceptance
- Purpose
- Be the ledger: canonicalize every significant operation into an append-only hash-chained event stream with signed checkpoints and independent verification.
- Workflows
- Canonicalize an event and compute its payload and event hashes
- Append to the chain with the previous event hash and issue a receipt
- Cut and sign a checkpoint, and rotate signing keys on schedule
- Verify record, sequence, signer and retention integrity independently of the application
- Raise a tamper alert when verification fails
- Primary objects
CanonicalEvent HashChain Checkpoint SigningKey VerificationReport
- Domain events
EVENT_CANONICALIZED EVENT_APPENDED CHECKPOINT_SIGNED SIGNING_KEY_ROTATED TAMPER_ALERT_RAISED
- Acceptance gate
- A third implementation, run by the reader, verifies the chain and the checkpoint signatures; removal, insertion and reordering are each poison-tested and each fail verification; signing keys live outside the application database; and no API can edit a historical event — a correction is a new event carrying CORRECTS.
- Role surfaces
- county · state
lockchainidentityofflinereportingobservability
31
Evidence Provenance
Origin, collector, capture method, custody, derivation graph, tools/versions, source relationships and findings linkage.
Constraint. Provenance answers where a record came from and how it was handled. It does not evaluate whether the content is true.
Workflows, objects, events, acceptance
- Purpose
- Record where a piece of evidence came from, who collected it how, what was derived from it with which tool, and what findings rest on it.
- Workflows
- Record origin, collector and capture method at ingestion
- Build the derivation graph as derivatives are produced
- Record the tool and version used for each derivation
- Link source relationships between related items
- Link findings back to the evidence they rest on
- Primary objects
ProvenanceRecord CaptureMethod DerivationEdge ToolVersion FindingLink
- Domain events
PROVENANCE_RECORDED DERIVATIVE_CREATED TOOL_VERSION_RECORDED SOURCE_RELATIONSHIP_LINKED FINDING_LINKED_TO_EVIDENCE
- Acceptance gate
- Every derivative resolves back to an original through a complete, unbroken graph, no derivation exists without a recorded tool and version, and a finding cannot be published without at least one evidence link.
- Role surfaces
- manager · county · state
lockchainevidenceidentityreporting
32
Photo / Video Evidence Capture
Managed-device capture, encrypted offline storage, upload acknowledgement, metadata, restricted originals and redaction derivatives.
Constraint. Redact at the point of storage: a derivative is generated for release, and the original stays restricted rather than being trimmed after the fact.
Workflows, objects, events, acceptance
- Purpose
- Capture photo and video on managed devices, hold it encrypted offline until acknowledged, and release only redacted derivatives by default.
- Workflows
- Capture on a managed, enrolled device with device identity bound to the media
- Store encrypted locally and queue for upload
- Confirm server receipt and show an unambiguous acknowledgement state
- Attach capture metadata and classification
- Produce a redaction derivative and restrict the original
- Primary objects
MediaCapture DeviceIdentity UploadQueueItem CaptureMetadata RedactionDerivative
- Domain events
MEDIA_CAPTURED MEDIA_QUEUED_ENCRYPTED MEDIA_UPLOAD_ACKNOWLEDGED REDACTION_DERIVATIVE_CREATED ORIGINAL_ACCESS_RESTRICTED
- Acceptance gate
- Capture is refused on an unmanaged device, local storage is encrypted at rest, the acknowledged state is visually distinct from the queued state, and the original is unreachable to any role that only holds derivative permission.
- Role surfaces
- worker · manager · county
lockchainevidenceidentityofflinereportingobservability
33
Document Authentication
Hash/signature verification, trusted-source registry, version comparison and explicit distinction among integrity, authority and truth.
Constraint. Maintain the explicit distinction among integrity, authority and truth. A verified signature shows the bytes are unaltered and who signed them; it says nothing about whether the content is correct.
Workflows, objects, events, acceptance
- Purpose
- Verify document hashes and signatures against a trusted-source registry, compare versions, and state plainly what verification does and does not establish.
- Workflows
- Register a trusted source and its verification material
- Verify a document hash and signature against that registry
- Compare two versions of a document section by section
- Report a verification result in three separate axes: integrity, authority, truth
- Record a failed verification as a finding rather than discarding it
- Primary objects
DocumentRecord TrustedSource VerificationResult VersionComparison IntegrityFinding
- Domain events
TRUSTED_SOURCE_REGISTERED DOCUMENT_VERIFIED VERIFICATION_FAILED VERSION_COMPARED INTEGRITY_FINDING_RAISED
- Acceptance gate
- The result surface always separates integrity, authority and truth, verification runs against known-good and known-bad fixtures in the test suite, and a failure is recorded and alerted rather than swallowed.
- Role surfaces
- manager · county · state
lockchainevidenceidentitycurrencyreporting
34
Audit Workspace
Scope, sampling, workpapers, evidence requests, findings, management responses and closure.
Constraint. Explicitly not exposed to ordinary field users: the Audit Workspace does not belong in a poll worker’s cognitive environment.
Workflows, objects, events, acceptance
- Purpose
- Give auditors a working surface: defined scope, defensible sampling, workpapers, evidence requests, findings, responses and closure.
- Workflows
- Define audit scope and record the sampling method and its parameters
- Maintain workpapers linked to the evidence they cite
- Issue an evidence request and track its fulfilment
- Raise a finding and record the management response
- Close the audit with a report that reproduces from its own workpapers
- Primary objects
AuditEngagement SamplingPlan Workpaper EvidenceRequest AuditFinding
- Domain events
AUDIT_SCOPE_DEFINED SAMPLE_DRAWN EVIDENCE_REQUEST_ISSUED AUDIT_FINDING_RAISED AUDIT_CLOSED
- Acceptance gate
- The sample is reproducible from its recorded parameters and seed, every finding cites a workpaper which cites evidence, and management responses are attributed and time-stamped.
- Role surfaces
- county · state
lockchainevidenceidentityjurisdictionreporting
35
Evidence Export / Legal Package Generator
Manifest, hashes, provenance, custody history, redactions, index, approvals and independent verification instructions.
Constraint. The package proves provenance, sequence, integrity and accountable handling. The verification instructions must say, in the package itself, that this is not proof that any allegation inside the records is true.
Workflows, objects, events, acceptance
- Purpose
- Assemble a self-verifying legal package: manifest, hashes, provenance, custody, applied redactions, index, approvals and instructions to verify it without BB2G.
- Workflows
- Select the scope of a package and resolve every included item
- Generate a manifest with hashes and a human-readable index
- Apply and record the redactions the classification requires
- Route the package for approval before release
- Emit independent verification instructions alongside the package
- Primary objects
EvidencePackage PackageManifest RedactionRecord PackageApproval VerificationInstructions
- Domain events
PACKAGE_ASSEMBLED PACKAGE_MANIFEST_HASHED REDACTION_APPLIED PACKAGE_APPROVED PACKAGE_RELEASED
- Acceptance gate
- A recipient with no BB2G access can verify every hash and the chain position of every item using only the instructions in the package, and an unapproved package cannot be released.
- Role surfaces
- manager · county · state
lockchainevidenceidentityjurisdictionreporting