Evidence Pack Format Spec

Current format version

pack_manifest.json schema

Every field in a single-meeting evidence/audit pack's manifest, in the order they appear at export time.

The hashing rule

sha256 is computed over every OTHER file in the pack — pack_manifest.json itself is excluded (it is only added to the ZIP after this hash is taken) — in ascending filename order, feeding each file's name then its UTF-8 content bytes into one running SHA-256 digest:

const sha256 = createHash('sha256')
for (const name of Object.keys(fileContents).sort()) {
  sha256.update(name)
  sha256.update(fileContents[name])
}
const packHash = sha256.digest('hex')

To verify a pack independently: unzip it, read every file except pack_manifest.json, sort the remaining filenames ascending, and for each one (in that order) feed its filename bytes then its content bytes into a single SHA-256 digest. Compare the resulting hex digest to the sha256 field declared in the pack's own pack_manifest.json — a match proves the pack has not been altered since export (tamper-evidence only; it does not by itself prove Protokol issued it — for that, pair it with /verify's provenance check against our audit log).

client_manifest.json schema

A whole-CLIENT evidence bundle (every "done" meeting for one client, exported as one client-pack-*.zip for FCA SYSC 9.1 "show me everything on client X" requests) declares its own root-level manifest, client_manifest.json, alongside one pack_manifest.json per included meeting subfolder (schema above, unchanged).

The client (root) hashing rule

root_sha256 is a hash-of-hashes, one level up from a single meeting's sha256: each included meeting's subfolder is hashed exactly like a single-meeting pack (the same rule above, excluding that folder's own pack_manifest.json), keyed into sha256_per_meeting by meeting_id. Those per-meeting hash STRINGS (not raw file bytes) are then sorted by meeting_id and concatenated into one more SHA-256 digest:

const sortedHashes = Object.keys(sha256PerMeeting).sort().map(k => sha256PerMeeting[k])
const rootSha256Hash = createHash('sha256').update(sortedHashes.join('')).digest('hex')

To verify a client bundle independently: recompute each meeting subfolder's hash the same way as a single-meeting pack, sort those hashes by meeting_id, concatenate the hash strings (in that sorted order — no separator), and SHA-256 the concatenation. Compare the resulting hex digest to the root_sha256 field declared in the bundle's own client_manifest.json — same tamper-evidence guarantee as a single-meeting pack's sha256, one level up.

Version history