Custody report

Operation Ledger — procurement irregularities

A signed, self-contained record of every item in this case — each receipt, the full append-only custody trail, and any redactions (with the original hash preserved). It verifies offline with just the public key below.

← Back to case
Offline verification result
report-verification.log
$ verify-report --offline
document signature: VALID ✓
receipt cmsh4r4z…: VALID ✓
receipt cmsh4r4z…: VALID ✓
receipt cmsh4r4z…: VALID ✓
redacted cmsh4r4z… original hash intact: YES ✓
overall: REPORT VERIFIES ✓
Preview report JSON
custody-report-operation-ledger-procurement-irregularities.json
{
  "version": "chain-of-custody-report:v1",
  "case": {
    "id": "cmsh4r4yh0000kocrjcr1imy4",
    "title": "Operation Ledger — procurement irregularities",
    "status": "open"
  },
  "generatedAt": "2026-09-04T08:05:55.371Z",
  "publicKey": "06e4b20eb506273408c360bd2e169ef3d113927187300ef3d88944698a64d409",
  "evidence": [
    {
      "id": "cmsh4r4zc0002kocrknyywhnc",
      "filename": "memo-leaked-budget.pdf",
      "sha256": "92c4f60ec3ef28ecc5566db15e9ff89f81f0a7f973c8a89f02e43726d4f29e62",
      "originalSha256": "92c4f60ec3ef28ecc5566db15e9ff89f81f0a7f973c8a89f02e43726d4f29e62",
      "sizeBytes": 184320,
      "source": "confidential source A",
      "capturedAt": "2026-08-06T03:23:45.115Z",
      "receipt": {
        "sha256": "92c4f60ec3ef28ecc5566db15e9ff89f81f0a7f973c8a89f02e43726d4f29e62",
        "capturedAt": "2026-08-06T03:23:45.115Z",
        "signature": "f960e284a5d212a6744d60652f7178658d078cd8311fa54bf5ae345a3f5a5641e5c331dd6ef07eb58f74dcb014c93f2bea285fbee9aa2bf4ff86e92807b0240a",
        "publicKey": "06e4b20eb506273408c360bd2e169ef3d113927187300ef3d88944698a64d409"
      },
      "custodyEvents": [
        {
          "actor": "reporter",
          "action": "add",
          "at": "2026-08-06T03:23:45.115Z"
        },
        {
          "actor": "editor",
          "action": "view",
          "at": "2026-08-06T03:53:45.115Z"
        },
        {
          "actor": "reporter",
          "action": "redact",
          "at": "2026-08-06T04:23:45.115Z"
        }
      ],
      "redactions": [
        {
          "region": {
            "reason": "masked source name and direct phone on page 2",
            "kind": "metadata"
          },
          "appliedAt": "2026-08-06T04:23:45.115Z"
        }
      ]
    },
    {
      "id": "cmsh4r4zh000akocrsdl6ipzq",
      "filename": "site-photo-0431.jpg",
      "sha256": "977ac703dd14eeb6be3456063cb3fdc5b8d1a5d5ba2e9b069e4c2c8ecd4653e2",
      "originalSha256": "977ac703dd14eeb6be3456063cb3fdc5b8d1a5d5ba2e9b069e4c2c8ecd4653e2",
      "sizeBytes": 2457600,
      "source": "field photographer (codename Osprey)",
      "capturedAt": "2026-08-06T04:23:45.147Z",
      "receipt": {
        "sha256": "977ac703dd14eeb6be3456063cb3fdc5b8d1a5d5ba2e9b069e4c2c8ecd4653e2",
        "capturedAt": "2026-08-06T04:23:45.147Z",
        "signature": "eae1843317ae5782a080ab0a3af5e76535da8afbb107918ee1e427ff975977367ff1681a2a2cc89670fd2c780bafe72470d6a38dc4c61d3bf0c2303f3283ed08",
        "publicKey": "06e4b20eb506273408c360bd2e169ef3d113927187300ef3d88944698a64d409"
      },
      "custodyEvents": [
        {
          "actor": "reporter",
          "action": "add",
          "at": "2026-08-06T04:23:45.147Z"
        },
        {
          "actor": "editor",
          "action": "view",
          "at": "2026-08-06T04:53:45.147Z"
        }
      ],
      "redactions": []
    },
    {
      "id": "cmsh4r4zk000ekocr6mefkx3a",
      "filename": "interview-recording.m4a",
      "sha256": "37170de8ea1c952f09db7faeacc06248d2426b977ef4ff7471b3f4fea1975f3c",
      "originalSha256": "37170de8ea1c952f09db7faeacc06248d2426b977ef4ff7471b3f4fea1975f3c",
      "sizeBytes": 11010048,
      "source": "whistleblower (sealed)",
      "capturedAt": "2026-08-06T05:23:45.150Z",
      "receipt": {
        "sha256": "37170de8ea1c952f09db7faeacc06248d2426b977ef4ff7471b3f4fea1975f3c",
        "capturedAt": "2026-08-06T05:23:45.150Z",
        "signature": "fa2af7aa2b78c93a819303a02b39181b7b621dc8d85588c8fa42fc835148c404321f4f478455fa1290616739034b49d4b6cc3a9743d7b9dcd838ddca62f5250d",
        "publicKey": "06e4b20eb506273408c360bd2e169ef3d113927187300ef3d88944698a64d409"
      },
      "custodyEvents": [
        {
          "actor": "reporter",
          "action": "add",
          "at": "2026-08-06T05:23:45.150Z"
        },
        {
          "actor": "editor",
          "action": "view",
          "at": "2026-08-06T05:53:45.150Z"
        }
      ],
      "redactions": []
    }
  ],
  "signature": "bcc31a988566030ade2ab893295b5c8290a624e0137f3e7e18914afee2c85a987e1923a5982c408ff474312d5a158f6519531aac6cca48613ae22e6727ba620a"
}

How a third party verifies this — no app, no server

  1. Take the downloaded custody-report-*.json and remove the top-level signature field.
  2. Canonicalize the remaining body (sort all keys recursively, compact JSON) — that is the exact message that was signed.
  3. Verify the Ed25519 signature against that message using the embedded publicKey. Each evidence receipt verifies the same way over chain-of-custody:v1:<sha256>:<capturedAt>.
  4. A ready-made offline checker ships at scripts/verify-report.mjs (Node + @noble, no network).

public_key: 06e4b20eb506273408c360bd2e169ef3d113927187300ef3d88944698a64d409

Ask AI

AI can be wrong. Not medical, legal, or financial advice.