Evidence ledger entry

Included from Basic tierpacks:security-governance

The evidence ledger is the append-only, hash-chained record governance surfaces write their attestations to: each row carries its payload, the previous row's hash and its own, so the chain verifies end to end and a break is detectable, acknowledgeable (a re-anchor) and never silently repairable. Served by the v2 GovernanceService: ListEvidenceLedger, VerifyEvidenceLedger, ExportEvidenceLedger, AppendAttestation, ReAnchorEvidenceLedger and SetEvidenceLegalHold.

EvidenceLedgerEntry

EvidenceLedgerEntry is one row of the append-only hash-chained evidence ledger.

Field	Type	Meaning
created_at	timestamp	When the record was created.
created_by	string	Username of the creating identity.
id	string	The record's identity.
kind	string	The row kind; "attestation" is the governance-foundation vocabulary.
legal_hold	boolean	A held row is exempt from every purge/retention path until explicitly unflagged. Administrative metadata outside the hashed content.
payload_json	string	The exact stored JSON payload — the bytes row_hash covers.
prev_hash	string	The previous row's row_hash ("" at genesis).
row_hash	string	SHA-256 over prev_hash and this row's content fields.
seq	integer/string	The chain position, 1-based and gap-free.

EvidenceRef

EvidenceRef is a typed citation to supporting evidence — a digest or id reference, never a copy.

Field	Type	Meaning
kind	string	The citation kind: "artifact" (a sha256: blob digest), "audit_event", "campaign", "export" (a manifest hash), "waiver", "external".
ref	string	The digest, id or locator the kind names.

EvidenceChainSegment

EvidenceChainSegment is one maximal verified run of ledger rows.

Field	Type	Meaning
end_seq	integer/string	The last seq of the verified run.
start_seq	integer/string	The first seq of the verified run.

EvidenceChainDiscontinuity

EvidenceChainDiscontinuity is one acknowledged break: the re-anchor row's recorded observation plus who re-anchored, and when.

Field	Type	Meaning
anchor_id	string	The re-anchor ledger row's id.
anchor_seq	integer/string	The re-anchor row's seq — the new segment starts here.
anchored_after_seq	integer/string	The last row of the broken segment as observed at re-anchor time.
broken_head_hash	string	The last stored row_hash as observed at re-anchor time.
justification	string	The operator's recorded incident story (mandatory at re-anchor).
observed_break_seq	integer/string	Where verification reported the break when the operator re-anchored.
re_anchored_at	timestamp	When the re-anchor was recorded.
re_anchored_by	string	Username of the operator who recorded the re-anchor.

Related pages

• opschain docs governance — attestation, verification, re-anchoring and the ledger's retention posture.
• opschain docs resources/campaign — the closing attestations campaigns append.
• opschain docs storage — sealed-segment archival and how legal hold guards cited evidence.