SkyQon — Evidence Export Bundle
=====================================================

Bundle format version : 1.0
Report ID             : b957a622-23c8-4ba6-a705-062999ecdfd6
Report type           : NIS2_MONTHLY
Period                : 2026-06-03T00:00:00+00:00 → 2026-07-03T23:59:59+00:00
Evidence SHA-256      : feabc20694f0f8cec269cfc0de18049b18a12a1da7bd804fb03a49de1cdbcfc3

CONTENTS
--------
  evidence-report.pdf   The rendered evidence report.
  summary.json          The canonical evidence payload (source of truth).
  manifest.json         Metadata + per-file SHA-256 + export provenance.
  README.txt            This file.

HOW TO VERIFY THIS BUNDLE
-------------------------
1. File integrity: recompute the SHA-256 of each file and compare it to the
   "files" map in manifest.json. (manifest.json is excluded from its own map.)

2. Evidence integrity (the important one): the evidence SHA-256 above is computed
   over summary.json using CANONICAL JSON — sorted keys, no whitespace,
   separators (",", ":"), UTF-8. Recompute it and compare to "content_sha256"
   in manifest.json. In Python:

       import json, hashlib
       payload = json.load(open("summary.json"))
       canon = json.dumps(payload, sort_keys=True, separators=(",", ":"),
                          default=str).encode("utf-8")
       print(hashlib.sha256(canon).hexdigest())

   A match proves the evidence payload is byte-for-byte what SkyQon recorded.

3. Issuer attestation: evidence-report.pdf carries an embedded PAdES signature from SkyQon's evidence signer (CN=SkyQon Evidence Signer), chaining to SkyQonManagementCA1. Validate it with any PAdES-capable tool (e.g. pyHanko) or upload this bundle at https://dashboard.skyqon.com/verify.
   The evidence SHA-256 above remains the primary integrity anchor.

WHY THIS BUNDLE EXISTS
----------------------
This is an immutable export taken before (or independently of) deleting the live
report row from the SkyQon database. Keeping this bundle off-box — and the
matching audit-log entry on the SkyQon platform — is what makes deletion of the
live evidence compliance-defensible. SkyQon provides configurable retention plus
this immutable export; it does not assert a legally-mandated retention period.
