{"proofpack_version":"1.3","generated_at":"2026-07-10T07:40:20.278352","partner_name":"Demo Care Operator (synthetic data)","incident_id":"c90bbb70-fbae-4369-ab6c-821d40df2c31","signing_class":"Source-signed (a device key verifiably signed this event at the source; PriviNet also sealed it at intake)","evidence_trust_assessment":{"assessment_version":"1.0","rulesets":{"source":"eta_source_v1","timing":"eta_timing_v1","cross_vendor":"eta_xvendor_v1","chain_of_custody":"eta_custody_v1","policy":"eta_policy_v1"},"summary_line":"Record is source-signed; 5 trust check(s) ran; no anomalies flagged.","sections":{"source_integrity":[{"check_id":"eta_source_v1.signing_state","ruleset_version":"eta_source_v1","status":"ok","observed":"Source-signed: a device or platform key verifiably signed this record."},{"check_id":"eta_source_v1.payload_bound","ruleset_version":"eta_source_v1","status":"ok","observed":"The source signature covers the payload as sealed."}],"timing":[{"check_id":"eta_timing_v1.receipt_delay","ruleset_version":"eta_timing_v1","status":"info","observed":"source-reported time to receipt: 0.0 s."}],"policy":[{"check_id":"eta_policy_v1.regulated_data","ruleset_version":"eta_policy_v1","status":"info","observed":"Tenant is synthetic/non-regulated; regulated fields are blocked at ingest and never sealed."},{"check_id":"eta_policy_v1.export_gate","ruleset_version":"eta_policy_v1","status":"info","observed":"Export/billing plan: free_pilot."}]},"checks_run":["eta_source_v1.signing_state","eta_source_v1.payload_bound","eta_timing_v1.receipt_delay","eta_policy_v1.regulated_data","eta_policy_v1.export_gate"],"anomalies":[],"note":"Enumerated trust signals for this record. Each line is a check that ran and what it observed. This assesses signals; it is not a verdict on whether the underlying event was true. No anomalies means none of the listed checks fired."},"canonical_inputs":{"normalized_payload":{"partner_id":"metalert","source_id":"smartsole_002","source_type":"gps","event_type":"gps.geofence_exit","timestamp":"2026-07-10T07:40:20.034551","received_at":"2026-07-10T07:40:20.034869","trigger_timestamp":"2026-07-10T07:40:20.034551","subject_id":null,"location":{"lat":34.0522,"lng":-118.2437,"accuracy_m":14},"payload":{"partner_id":"metalert","device_id":"smartsole_002","event_type":"geofence_exit","timestamp":"2026-07-10T07:40:20.034551","trigger_timestamp":"2026-07-10T07:40:20.034551","lat":34.0522,"lng":-118.2437,"speed":1.6,"bearing":270,"battery":22,"gps_accuracy_m":14,"zone_id":"home","zone_name":"Home","caregiver_acknowledged":false,"pre_trigger_window_seconds":10,"post_trigger_window_seconds":10},"metadata":{"speed":1.6,"bearing":270,"battery":22,"zone_id":"home","zone_name":"Home","time_of_day":null,"caregiver_acknowledged":false},"evidence_window":{"pre_trigger_window_seconds":10,"post_trigger_window_seconds":10}},"analysis":{"risk_score":1.0,"urgency":"critical","classification":"high_risk_wandering","explanation":"User exited a known safe zone at an unusual nighttime hour, with battery low (22%), and no caregiver acknowledgment has been recorded. Risk score 1.0.","recommended_action":"Notify the primary caregiver immediately and escalate to backup caregiver if no acknowledgment occurs within 3 minutes.","confidence":0.85,"watcher_score":10,"escalation_required":true,"escalation_reason":"Watcher score 10/10 with urgency 'critical' and classification 'high_risk_wandering'.","secondary_ai_status":"placeholder","ruleset_name":"gps_wandering_v1","ruleset_version":"0.1.0","analysis_version":"0.1.0"},"evidence_window":{"pre_trigger_window_seconds":10,"post_trigger_window_seconds":10,"evidence_window_start":"2026-07-10T07:40:10.034551","evidence_window_end":"2026-07-10T07:40:30.034551","proof_window_available":false,"proof_window_policy":null,"proof_window_reference":null,"media_digest_pre":null,"media_digest_trigger":null,"media_digest_post":null}},"canonicalization_spec":"Canonical JSON, matching the producer exactly: json.dumps(obj, sort_keys=True, separators=(',', ':'), ensure_ascii=False), encoded UTF-8. datetimes are ISO-8601 strings as already serialized in canonical_inputs. Hash each canonical_inputs object exactly as given; do not re-map or reorder.","bundle":{"event":{"id":"c90bbb70-fbae-4369-ab6c-821d40df2c31","partner_id":"29d8b6e1-ac4f-4402-a08d-b714949f3fd4","source_type":"gps","event_type":"gps.geofence_exit","external_event_id":null,"timestamp":"2026-07-10T07:40:20.034551","received_at":"2026-07-10T07:40:20.034869","trigger_timestamp":"2026-07-10T07:40:20.034551","subject_id":null,"normalized_payload":{"partner_id":"metalert","source_id":"smartsole_002","source_type":"gps","event_type":"gps.geofence_exit","timestamp":"2026-07-10T07:40:20.034551","received_at":"2026-07-10T07:40:20.034869","trigger_timestamp":"2026-07-10T07:40:20.034551","subject_id":null,"location":{"lat":34.0522,"lng":-118.2437,"accuracy_m":14},"payload":{"partner_id":"metalert","device_id":"smartsole_002","event_type":"geofence_exit","timestamp":"2026-07-10T07:40:20.034551","trigger_timestamp":"2026-07-10T07:40:20.034551","lat":34.0522,"lng":-118.2437,"speed":1.6,"bearing":270,"battery":22,"gps_accuracy_m":14,"zone_id":"home","zone_name":"Home","caregiver_acknowledged":false,"pre_trigger_window_seconds":10,"post_trigger_window_seconds":10},"metadata":{"speed":1.6,"bearing":270,"battery":22,"zone_id":"home","zone_name":"Home","time_of_day":null,"caregiver_acknowledged":false},"evidence_window":{"pre_trigger_window_seconds":10,"post_trigger_window_seconds":10}},"evidence_window":{"pre_trigger_window_seconds":10,"post_trigger_window_seconds":10,"evidence_window_start":"2026-07-10T07:40:10.034551","evidence_window_end":"2026-07-10T07:40:30.034551","proof_window_available":false,"proof_window_reference":null,"media_digest_pre":null,"media_digest_trigger":null,"media_digest_post":null},"incoming_proof_status":"edge_signed_verified"},"analysis":{"id":"233f9e52-c3db-4c5c-b838-f0dcc3d6ef30","risk_score":1.0,"urgency":"critical","classification":"high_risk_wandering","explanation":"User exited a known safe zone at an unusual nighttime hour, with battery low (22%), and no caregiver acknowledgment has been recorded. Risk score 1.0.","recommended_action":"Notify the primary caregiver immediately and escalate to backup caregiver if no acknowledgment occurs within 3 minutes.","watcher_score":10,"escalation_required":true,"escalation_reason":"Watcher score 10/10 with urgency 'critical' and classification 'high_risk_wandering'.","ruleset_name":"gps_wandering_v1","ruleset_version":"0.1.0","analysis_version":"0.1.0"},"proof_record":{"id":"fd281e84-7d16-4b2a-991c-e9500bbfcaae","event_hash":"b5a6ae0fceb89c2fe329f00c3e93a801076896ad6840188956c36bd17d9f1259","normalized_payload_hash":"397f3c447aa14e3d3a3d219e67b1b58d03da6844ffa34e8518582b3d4037faea","analysis_hash":"7cedab4558e9f0b1eb46f775e85bc0f169f2dd8e80e5d3f748fccff05ffd14d2","evidence_window_hash":"24fd4da9528969c9e710b48a6ea227d35c1bec1530302e6cf1f37df0ec2f9f18","signature":"3045022100fd05b1a6c3329e9d464988a0a6269ff36a1ebc25e74e743e1f3261b7e15ffd9502200f5166da82ae279a5b8cb88929c041d1fa9a903d89d7eda6b1d8a8fa0a97b7b1","signer_type":"kms_hsm_key","key_id":"kms-1944107aa98ec035","public_key_hex":"04bc55de97e806fbeaf95298588a87cf7f1404640f7b9d359fbbc0f1b2bf408f8be837d1cfa641778a11fd9776be566a2c938b8891d29a7182c15500a05b2e6655","algorithm":"ecdsa-p256-sha256","signed_at":"2026-07-10T07:40:20.195540","proof_mode":"platform_secondary_signature","raw_payload_hash":"d45b0beaa89e930300a3d4c492731a88db2de78cb45847a5aefe2acc8d9d827f","hash_context":"privinet.lumra.v1.event-proof","signer_note":"PriviNet production key held in a cloud HSM (non-extractable; not itself a third-party time-stamp or CA anchor)"},"edge_binding":{"incoming_proof_status":"edge_signed_verified","device_key_id":"metalert-smartsole-002","device_public_key_hex":"5cbf574f7a61a92010178d69ada7a33736a23f0f8e279cd360f67c89cf157242","device_signature":"917e8c3f2c3c36994d617b3b454e0257df6a97b35a980c97bc103f76acaeb8415339a98dc1b2467346288e2da66c0558c75f248e3558916faee342ce098e9c0f","device_algorithm":"ed25519","signed_digest":"d45b0beaa89e930300a3d4c492731a88db2de78cb45847a5aefe2acc8d9d827f","device_signed_payload":{"partner_id":"metalert","device_id":"smartsole_002","event_type":"geofence_exit","timestamp":"2026-07-10T07:40:20.034551","trigger_timestamp":"2026-07-10T07:40:20.034551","lat":34.0522,"lng":-118.2437,"speed":1.6,"bearing":270,"battery":22,"gps_accuracy_m":14,"zone_id":"home","zone_name":"Home","caregiver_acknowledged":false,"pre_trigger_window_seconds":10,"post_trigger_window_seconds":10},"edge_digest_matches_payload":true,"how_to_verify":"sha256 of the canonical JSON of device_signed_payload must equal signed_digest; then device_signature must verify over signed_digest using device_public_key_hex (Ed25519). Confirm device_public_key_hex at privinet.net/keys.txt."},"evidence_trust_assessment":{"assessment_version":"1.0","rulesets":{"source":"eta_source_v1","timing":"eta_timing_v1","cross_vendor":"eta_xvendor_v1","chain_of_custody":"eta_custody_v1","policy":"eta_policy_v1"},"summary_line":"Record is source-signed; 5 trust check(s) ran; no anomalies flagged.","sections":{"source_integrity":[{"check_id":"eta_source_v1.signing_state","ruleset_version":"eta_source_v1","status":"ok","observed":"Source-signed: a device or platform key verifiably signed this record."},{"check_id":"eta_source_v1.payload_bound","ruleset_version":"eta_source_v1","status":"ok","observed":"The source signature covers the payload as sealed."}],"timing":[{"check_id":"eta_timing_v1.receipt_delay","ruleset_version":"eta_timing_v1","status":"info","observed":"source-reported time to receipt: 0.0 s."}],"policy":[{"check_id":"eta_policy_v1.regulated_data","ruleset_version":"eta_policy_v1","status":"info","observed":"Tenant is synthetic/non-regulated; regulated fields are blocked at ingest and never sealed."},{"check_id":"eta_policy_v1.export_gate","ruleset_version":"eta_policy_v1","status":"info","observed":"Export/billing plan: free_pilot."}]},"checks_run":["eta_source_v1.signing_state","eta_source_v1.payload_bound","eta_timing_v1.receipt_delay","eta_policy_v1.regulated_data","eta_policy_v1.export_gate"],"anomalies":[],"note":"Enumerated trust signals for this record. Each line is a check that ran and what it observed. This assesses signals; it is not a verdict on whether the underlying event was true. No anomalies means none of the listed checks fired."}},"manifest":{"manifest_version":"2","incident_id":"c90bbb70-fbae-4369-ab6c-821d40df2c31","generated_at":"2026-07-10T07:40:20.278352","event_hash":"b5a6ae0fceb89c2fe329f00c3e93a801076896ad6840188956c36bd17d9f1259","key_id":"kms-1944107aa98ec035","signer_type":"kms_hsm_key","algorithm":"ecdsa-p256-sha256","public_key_hex":"04bc55de97e806fbeaf95298588a87cf7f1404640f7b9d359fbbc0f1b2bf408f8be837d1cfa641778a11fd9776be566a2c938b8891d29a7182c15500a05b2e6655","signed_at":"2026-07-10T07:40:20.195540","signing_class":"Source-signed (a device key verifiably signed this event at the source; PriviNet also sealed it at intake)","canonical_inputs_sha256":"6dc34949a3deffe99383c3559f817f862cb6330af4dd90a69c4b076a30c0df3a","bundle_sha256":"77e6c1f442656da3bc10a2dc821a840a49f4aa24925f207fb98de2d1f1e69993","timestamp_anchor_status":"anchored","timestamp_anchor_imprint_sha256":"453bf57220aa7870661aa8cfb5d94b84d2ce5104db6ca48387d94a97d2b497f0"},"manifest_signature":{"signs":"sha256 hex of the canonical JSON of `manifest`","manifest_digest":"546cdfb8fac30fcc066b374c12ab1286c0cfa7404c668b608f8622c7e90f9a96","signature":"304502202ede2c11e5d7b16b5428f53d03da531a1901760945551a5c37dfbc526d8a6df1022100a2e05eb000309369c65a220d1bd892764f983cec6b21a3eec6301644ac8e31a9","key_id":"kms-1944107aa98ec035","public_key_hex":"04bc55de97e806fbeaf95298588a87cf7f1404640f7b9d359fbbc0f1b2bf408f8be837d1cfa641778a11fd9776be566a2c938b8891d29a7182c15500a05b2e6655","algorithm":"ecdsa-p256-sha256"},"timestamp_anchor":{"status":"anchored","standard":"RFC 3161","authority":"https://freetsa.org/tsr","authorities_tried":["https://freetsa.org/tsr"],"hashed_field":"sha256 of the ASCII bytes of event_hash","imprint_sha256":"453bf57220aa7870661aa8cfb5d94b84d2ce5104db6ca48387d94a97d2b497f0","obtained_at":"2026-07-10T07:40:20.278590","token_der_base64":"MIISFTADAgEAMIISDAYJKoZIhvcNAQcCoIIR/TCCEfkCAQMxDzANBglghkgBZQMEAgMFADCCAYYGCyqGSIb3DQEJEAEEoIIBdQSCAXEwggFtAgEBBgQqAwQBMDEwDQYJYIZIAWUDBAIBBQAEIEU79XIgqnhwZhqoz7XZS4TSzlEE22ykg4fZSpfStJfwAgQGF0u5GA8yMDI2MDcxMDA3NDAyMFoBAf+gggETpIIBDzCCAQsxETAPBgNVBAoMCEZyZWUgVFNBMQwwCgYDVQQLDANUU0ExdjB0BgNVBA0MbVRoaXMgY2VydGlmaWNhdGUgZGlnaXRhbGx5IHNpZ25zIGRvY3VtZW50cyBhbmQgdGltZSBzdGFtcCByZXF1ZXN0cyBtYWRlIHVzaW5nIHRoZSBmcmVldHNhLm9yZyBvbmxpbmUgc2VydmljZXMxGDAWBgNVBAMMD3d3dy5mcmVldHNhLm9yZzEkMCIGCSqGSIb3DQEJARYVYnVzaWxlemFzQG1haWxib3gub3JnMRIwEAYDVQQHDAlXdWVyemJ1cmcxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm6ggg5nMIIGYDCCBEigAwIBAgIJAMLphhYNqOnNMA0GCSqGSIb3DQEBDQUAMIGVMREwDwYDVQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZyZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIwEAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUwHhcNMjYwMjE1MTk0NDIyWhcNNDAwMjAyMTk0NDIyWjCCAQsxETAPBgNVBAoMCEZyZWUgVFNBMQwwCgYDVQQLDANUU0ExdjB0BgNVBA0MbVRoaXMgY2VydGlmaWNhdGUgZGlnaXRhbGx5IHNpZ25zIGRvY3VtZW50cyBhbmQgdGltZSBzdGFtcCByZXF1ZXN0cyBtYWRlIHVzaW5nIHRoZSBmcmVldHNhLm9yZyBvbmxpbmUgc2VydmljZXMxGDAWBgNVBAMMD3d3dy5mcmVldHNhLm9yZzEkMCIGCSqGSIb3DQEJARYVYnVzaWxlemFzQG1haWxib3gub3JnMRIwEAYDVQQHDAlXdWVyemJ1cmcxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCYXllcm4wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASiFeGhstbLhxix0o4UAumNSwHUUlOe3DBvs8fYs580wADW59oqGSCx15bp61TSmXkwLm1JW48XnbLLizP6ZtjcvshV3H9uz2bS53sgDXhg1wLbIhAtraC+fHCytHeuVaujggHmMIIB4jAJBgNVHRMEAjAAMB0GA1UdDgQWBBQVwL0m69RdgtFdkyYxL+9wsotGXjAfBgNVHSMEGDAWgBT6VQ2MNGZRQ0z357OnbJWveuaklzALBgNVHQ8EBAMCBsAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwgwbAYIKwYBBQUHAQEEYDBeMDMGCCsGAQUFBzAChidodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZpbGVzL2NhY2VydC5wZW0wJwYIKwYBBQUHMAGGG2h0dHA6Ly93d3cuZnJlZXRzYS5vcmc6MjU2MDA3BgNVHR8EMDAuMCygKqAohiZodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2NybC9yb290X2NhLmNybDCByAYDVR0gBIHAMIG9MIG6BgMrBQgwgbIwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMuaHRtbDAyBggrBgEFBQcCARYmaHR0cDovL3d3dy5mcmVldHNhLm9yZy9mcmVldHNhX2Nwcy5wZGYwRwYIKwYBBQUHAgIwOxo5RnJlZVRTQSB0cnVzdGVkIHRpbWVzdGFtcGluZyBTb2Z0d2FyZSBhcyBhIFNlcnZpY2UgKFNhYVMpMA0GCSqGSIb3DQEBDQUAA4ICAQBrMVS/YfnfMr0ziZnesBUOrDNRrNNgt3IgMNDwNhwl6oKWHVIhlYnM/5boljfbpZTAbqvxHI3ztT0/swxQOqTat5qBJRAY/VH1n/T4M9uDjSuu3qfh0ZH5PL9ENqoVW44i5NT/znQev2MGXOAHwz9kZwwzz9MFX6hbGhBqWa+nlAqb7Y72KFzj33m1OVHxV2Wl4YD9f91bZTFpUEGW4Ktbkmxpf/iGIPaf4WHpoBW/O6EzofMKYlz4yXyEBh0wRRVyXltLrj+MFHqhe+PsMBllq/dCaO4W/F+AuHElu7aUYWMASelphWAJiUsNMr5HAoeCSSgilqf1CSoWC+k6e4334Fym+Iy4csMex+PG4rSdqXJVQ+AWEdRajSPKh7yDfpNkdnO6yqQJ/tSd11XQ5cL0M9jWuCD1zHlgA+u+R2cry3yo23jD7qTGLhZqUvXCyWigH30/Q/RXjjDwrc4DJiQ+gRY0FhdTYqlvgMBPr4LcJKnNksivdj+kbz7bVSbrBAzRiazK9l841/5XMtP9BvD0hKCpQFvP9PSgCC8EQnKqgSe26FSJBaAQcA5TnK8NF4jkbElBxf/zyh7P3IjHso35jtgUWD1/itg9BJWbYUwJ4tfILpB2F0wbk1GcZDCDZoyW3Xf3trApz/Zd93gF3joc9Hh9RFveKRzWQ7ddUt3egTCCB/8wggXnoAMCAQICCQDB6YYWDajpgDANBgkqhkiG9w0BAQ0FADCBlTERMA8GA1UEChMIRnJlZSBUU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEiMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3VlcnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFMB4XDTE2MDMxMzAxNTIxM1oXDTQxMDMwNzAxNTIxM1owgZUxETAPBgNVBAoTCEZyZWUgVFNBMRAwDgYDVQQLEwdSb290IENBMRgwFgYDVQQDEw93d3cuZnJlZXRzYS5vcmcxIjAgBgkqhkiG9w0BCQEWE2J1c2lsZXphc0BnbWFpbC5jb20xEjAQBgNVBAcTCVd1ZXJ6YnVyZzEPMA0GA1UECBMGQmF5ZXJuMQswCQYDVQQGEwJERTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALYCjg4wMvERENlkzalLnQJ44ZQq6ROqpZkHzaaXk5lb2ax+M7rZ/jcE2hwBqY0hr+P1kaWdcGdwUWeZj1AWci4KtGKyH0ORcdLPzEWT83Na95SlqzEfbAEMeJjeM9dcRRDudvS9HRSYzxfTA/BqXdn3lsxsqbZXpW/j6k/vvnzmtqGNPjWjDO5f8XDRzzmjM9P9qJZNIttoWynlYb6JDwqoRYc7LoSrJquDn/6PrenSO7MeYdJzzJuIBkkYX6vs+gU0YAq6kBthTi6FRYLeoiJvwZzX31K+1Q2Hd82ZiMBTo/x9wyh6BopP8StxPNmANmbpVThUVv84+AKYz2uThW6SJHdKZs8c3RHC+O/YUgPXRYslZksT7WOc3tT/gRPWzFNT0nKUc8PDBxV8ciqltd0L+y1sOLG5N0nIgexgAm0IlRs4JL1xusvORzrr1jbwuRi0osj/RpTwdFevLW8c+CVU0XcP15/10xTc0QTN3KvJQTgFbfzwF+frhXL9UvcBRPGI2gX1gj9Y3QYpfnOHvtLXcsE9qCZmAQRf5BLdcJhsDJh7pzRLkDc4dRbSWOeIW1H4lot/JgEhO8TLTIX4/wuEr2qYgzfN+4GGj37PMdymcW1+wt2ALBZyYp5cAFLLNX3Smq/EP2FbOx/51OHOCMccc+H+u33FajNiEynp7WwjAgMBAAGjggJOMIICSjAMBgNVHRMEBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQU+lUNjDRmUUNM9+ezp2yVr3rmpJcwgcoGA1UdIwSBwjCBv4AU+lUNjDRmUUNM9+ezp2yVr3rmpJehgZukgZgwgZUxETAPBgNVBAoTCEZyZWUgVFNBMRAwDgYDVQQLEwdSb290IENBMRgwFgYDVQQDEw93d3cuZnJlZXRzYS5vcmcxIjAgBgkqhkiG9w0BCQEWE2J1c2lsZXphc0BnbWFpbC5jb20xEjAQBgNVBAcTCVd1ZXJ6YnVyZzEPMA0GA1UECBMGQmF5ZXJuMQswCQYDVQQGEwJERYIJAMHphhYNqOmAMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly93d3cuZnJlZXRzYS5vcmcvcm9vdF9jYS5jcmwwgc8GA1UdIASBxzCBxDCBwQYKKwYBBAGB8iQBATCBsjAzBggrBgEFBQcCARYnaHR0cDovL3d3dy5mcmVldHNhLm9yZy9mcmVldHNhX2Nwcy5odG1sMDIGCCsGAQUFBwIBFiZodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZyZWV0c2FfY3BzLnBkZjBHBggrBgEFBQcCAjA7GjlGcmVlVFNBIHRydXN0ZWQgdGltZXN0YW1waW5nIFNvZnR3YXJlIGFzIGEgU2VydmljZSAoU2FhUykwNwYIKwYBBQUHAQEEKzApMCcGCCsGAQUFBzABhhtodHRwOi8vd3d3LmZyZWV0c2Eub3JnOjI1NjAwDQYJKoZIhvcNAQENBQADggIBAGivfr+ThWLvTOs7WAvi+vbMNaJncpYvPZWQH6VjDIfQkZiYTOigajP4qcKC7Z8csRrGwj4XEI7k785vspTelcEzJiJVclUiymGXHUo7f3glDfuNSu7A+xlZsWQQBSC5wQ5kxiZi5K1NCrriKY/JSPxOmejZ5rj9vkQEEh7HwUIurLLJ1zKOBzluYLTzu4A61KVVyA/vtT+F53ZKCp+0r8OZ9M0vX79YcQXGCBzz0FM3trt9GwELdJ9IiMkS82lrobaQLXe338BGwEoMwexPjRheLaVd+3vCogNsYhkkak+Z3btvH4KTmPO4A9wK2Q3LWb70wnx3QEuZBDt4JxhnmRFSw5nxLL/ExiWtwJY1WuRONCEA7FF6UC4vBvlAuNQ1mbvBFU+K52GgsNVV+0oTkdTzQgr42/EvLX3bnXfc4VN4BAdK8XXk8tbVWzS11vfcvdMXMK9WSA1MDP8UP56DvBUYZtC6Dwu9xH/ieGQXa71sGrhd8yXt93eIm8RHG/P6c+VsxZHosWDNp7B4ah7ASsOyT6LijV0Z5eSABNXhZqg8guxv1U+zheuvcTOoW1LeRttSROHDSujTbnEvn84NST19Pt1YbGGY4+w+bpY0b0F6yfIh4K/zOo9qCx70wCNjC3atqo2RQzgl7MQcSaW5ixgcfaMOmXq5VMc8LNgFr9qZMYIB7DCCAegCAQEwgaMwgZUxETAPBgNVBAoTCEZyZWUgVFNBMRAwDgYDVQQLEwdSb290IENBMRgwFgYDVQQDEw93d3cuZnJlZXRzYS5vcmcxIjAgBgkqhkiG9w0BCQEWE2J1c2lsZXphc0BnbWFpbC5jb20xEjAQBgNVBAcTCVd1ZXJ6YnVyZzEPMA0GA1UECBMGQmF5ZXJuMQswCQYDVQQGEwJERQIJAMLphhYNqOnNMA0GCWCGSAFlAwQCAwUAoIG4MBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUxDxcNMjYwNzEwMDc0MDIwWjArBgsqhkiG9w0BCRACDDEcMBowGDAWBBRIH9U8U004QYDAKGUZoDb5iFRHZjBPBgkqhkiG9w0BCQQxQgRAlQ/ZffEfhl5J478hRnDWWu4aoT8BVsI3R5XFpYOHbgPlOpO9wJR/TM2aFptEYRYvqEaYt5O+iycOwYBb6tH6WTAKBggqhkjOPQQDBARnMGUCMA1wuF1P3op61/jCz2PzmbZEfiS9xsfMxxByzyzjWkGL294t6U+Th69Vn63fnVkeYQIxAOVD4xWguO2p7iLeWqNriuwAyQxbFkAR3f9Am4vM7N98QAHe4b1VM0+Np7YlM5r6dw==","verify_instructions":"This is a standard RFC 3161 timestamp response over sha256(event_hash). Decode token_der_base64 to a .tsr file and verify with the authority's certificate: openssl ts -verify -data <file-with-event_hash> -in token.tsr -CAfile <authority-ca.pem>. A valid token proves this event_hash existed no later than the token's time, independent of PriviNet."},"verification":{"intact":true,"components":{"normalized_payload":true,"analysis":true,"evidence_window":true,"composite":true},"recomputed_event_hash":"b5a6ae0fceb89c2fe329f00c3e93a801076896ad6840188956c36bd17d9f1259","stored_event_hash":"b5a6ae0fceb89c2fe329f00c3e93a801076896ad6840188956c36bd17d9f1259","signature_status":"cloud_signed","signature_valid":true,"checked_at":"2026-07-10T07:40:20.277686"},"verifier_instructions":"This ProofPack is self-verifying with open tools and no PriviNet servers.\nHash the objects under canonical_inputs (NOT the human-readable bundle,\nwhich is a display view). Use the canonicalization_spec exactly.\n1. Recompute SHA-256 over the canonical JSON of canonical_inputs.normalized_payload, .analysis, and .evidence_window. Confirm each matches\n   proof_record.normalized_payload_hash, analysis_hash, and\n   evidence_window_hash respectively (an omitted evidence_window means the\n   stored evidence_window_hash is null).\n2. Recompute the composite: SHA-256 of the UTF-8 string\n   'privinet.lumra.v1.event-proof|<payload_hash>|<analysis_hash>|<evidence_window_hash or empty>'.\n   Confirm it matches proof_record.event_hash.\n3. Verify proof_record.signature over the ASCII bytes of event_hash using\n   proof_record.public_key_hex, per proof_record.algorithm:\n   - ed25519: 32-byte public key (hex), 64-byte raw signature (hex).\n   - ecdsa-p256-sha256: 65-byte uncompressed P-256 public key (hex,\n     leading 04), DER-encoded ECDSA signature (hex), message hashed with\n     SHA-256 (standard ECDSA verify over the ASCII bytes of event_hash).\nA single altered byte in any canonical_inputs object breaks step 1, 2, or 3.","declaration_template":"CERTIFICATION OF RECORD GENERATED BY AN ELECTRONIC PROCESS\n(template pursuant to Federal Rules of Evidence 902(13) and 902(14);\nfor review and signature by a qualified person or records custodian;\nnot legal advice; self-authentication does not guarantee admissibility)\n\nI, __________________________ [name], state that I am a qualified person\nwith knowledge of the PriviNet Lumra system that produced the records\ndescribed below, and I certify the following of my own knowledge:\n\n1. Incident record identifier: c90bbb70-fbae-4369-ab6c-821d40df2c31\n2. Event type and time: gps.geofence_exit at 2026-07-10T07:40:20.034551 (UTC)\n3. The record was signed by key_id kms-1944107aa98ec035 using kms_hsm_key\n   (ecdsa-p256-sha256) at 2026-07-10T07:40:20.195540 (UTC).\n   The signing key is held in a cloud hardware security module and is\n   non-extractable from it. This signature attests integrity; it is not\n   itself a third-party time-stamp or certificate-authority anchor.\n4. Composite record digest (SHA-256): b5a6ae0fceb89c2fe329f00c3e93a801076896ad6840188956c36bd17d9f1259\n5. Public verification key (hex): 04bc55de97e806fbeaf95298588a87cf7f1404640f7b9d359fbbc0f1b2bf408f8be837d1cfa641778a11fd9776be566a2c938b8891d29a7182c15500a05b2e6655\n6. The records are copies of data generated by an automated electronic\n   process shown to produce an accurate result, and the digests above\n   identify the records as unaltered.\n7. On 2026-07-10T07:40:20.547722 (UTC) the digests were recomputed from the records and the\n   signature was checked; the result was: integrity True,\n   signature_valid True.\n\nI declare under penalty of perjury that the foregoing is true and correct.\n\nSignature: __________________________   Date: ______________\nTitle/Role: _________________________\n","analysis_disclaimer":"The analysis section is PriviNet Lumra's automated, ruleset-based classification produced at intake. It is provided for context only. It is not a determination of what occurred, whether any action was or was not required, or who is at fault, and it should not be read as one. The evidentiary value of this ProofPack is that the signed records are authentic and unaltered, which anyone can verify.","notice":"Verification of these records is free and requires no PriviNet servers. This assembled, certification-ready ProofPack is a paid deliverable. Records are signed with PriviNet's published signing key (directory at privinet.net/keys.txt; the production key is held in a cloud HSM and is non-extractable); a manifest signature binds the entire document, and an independent timestamp anchor, when present, fixes the record in time without relying on PriviNet's clock. The analysis section is an automated classification, not a determination of fact or liability. Self-authentication under FRE 902(13)/(14) is effected through a qualified person's written certification and does not by itself guarantee admissibility.","sandbox_notice":"Synthetic demonstration incident from the public demo tenant. Every hash and signature is real and independently verifiable; the underlying event is not.","evidence_archive":{"status":"sandbox_not_retained","note":"Sandbox pack; not written to durable storage. In production each ProofPack is written to immutable, retention-protected Cloud Storage."}}