Chapter 48 — Evidence dossier
Lesson map
Lesson 48 published. Map, example, EX142.
flowchart TD
N0["Learning outcomes"]
N1["48.1 Contents"]
N2["48.2 Retention"]
N3["48.3 Exclusions"]
N4["Practice note"]
N5["48.1b Reader checklist and redaction log"]
N6["Field note — automated dossier"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX142"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["48.1 Contents"]
N2["48.2 Retention"]
N3["48.3 Exclusions"]
N4["Practice note"]
N5["48.1b Reader checklist and redaction log"]
N6["Field note — automated dossier"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX142"]
[Learning outcomes]
|
v
[48.1 Contents]
|
v
[48.2 Retention]
|
v
[48.3 Exclusions]
|
v
[Practice note]
|
v
[48.1b Reader checklist and redaction log]
|
v
[Field note — automated dossier]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX142]
Learning outcomes
You will (1) assemble a dossier a third party can re-hash; (2) structure retention classes; (3) exclude dual-use and proprietary material.
48.1 Contents
Work permit PDF, ConduitSet/allow-list JSON, finding exports, evidence objects, hash manifest, tool versions, lab reports. Reader can verify without trusting your laptop.
Lena's CNHP dossier at ABP contains the signed work permit, the zone model and allow-list v1.4.2 as files, finding exports, the evidence objects, a hash manifest, tool versions and the laboratory reports. An auditor can take the dossier to a clean machine and check every hash against the manifest, without needing access to Lena's laptop or her account. The first page explains how to do this in a few steps.
48.2 Retention
Classes: window working (90 days), sealed evidence (agreed years), aggregate metrics (longer). Deletion jobs are tested.
At ABP, working data from each window is kept for 90 days, and sealed evidence for safety-relevant change records is kept for seven years, following the site's record schedule. Aggregate metrics, such as the alarm rate falling from 556 to 176 per week, are kept longer. Lena tests the deletion job each quarter on a copy of the store, so that expired working data is actually removed rather than assumed gone.
48.3 Exclusions
No payloads, no live credentials, no proprietary batch genealogy. An item that could not be shown safely to ABP's counsel stays out of the dossier.
Synthetic case — Ashford Batch Plant. Dossier v3 re-hashed clean after a findings.json edit incident; process note included.
Lena checks each file against the exclusion list before sealing; a single match stops the build and names the offending file, which is how a raw capture left in the version-two working folder was caught. After a findings file was edited by mistake, version three was re-hashed and the process note explains how the error was found.
48.4 Errors and limits
Dossiers in personal cloud accounts fail residency and retention.
At ABP a contractor once copied window evidence to a personal cloud folder to work from home. The folder was outside the site's retention schedule and outside the approved data location, so the copy was deleted and the evidence restored from the sealed store. Lena's dossier now lives only in the controlled store, and the manifest records its location, so any copy elsewhere is clearly unofficial and can be identified during an audit.
Practice note
Automate dossier builds from tags. Manual dragging of files is how findings get edited after seal.
48.1b Reader checklist and redaction log
Include a one-page how to verify this dossier at the top. When Lena redacts a capture or a diagram, the redaction log (what, why, actor) stays inside the sealed store. Someone outside CNHP re-hashes the dossier as a drill. Manifest generation fails the build if any path matches a forbidden-name regex, such as one for PLC project files or password exports.
Third-party readability: if outsiders cannot find the manifest or the work-permit version, the dossier fails. Once per term, restoring the CNHP dossier on a clean machine is run as a graded exercise.
Lena's dossier passes this test each term.
Field note — automated dossier
make dossier ENG=2026-03-abp produces the zip and manifest. After automation, the findings.json post-seal edit class of incident stopped. The happy path became the safe path.
Redactions are reviewed by a second person before the dossier is sealed.
A failed re-hash drill is filed as a finding against the dossier build, not against the reader.
The build tag is printed on the dossier's first page beside the manifest hash.
48.5 Worked example — what goes in, what stays out (synthetic ABP)
Lena's CNHP evidence dossier includes the zone model and its version, conformance results, laboratory reports, the validation re-test, open findings with owners and the residual-risk acceptance signed by the plant manager. It excludes raw packet captures, passwords and recipe parameters, replacing them with hashes and pointers to the controlled store; the redaction log lists each exclusion and why. Retention follows the site's record schedule: seven years for safety-relevant change records. The reader checklist on page one tells an auditor how to verify any hash against the stored originals.
Exercises
- EX142 — Manifest. Sketch a hash manifest format (3 rows). Rubric: 3 = path+algo+digest; 2 = digests only; 1 = vague; 0 = none.
- EX143 — Class. Retention class for work permit PDF vs scratch notes. Rubric: 3 = sealed vs working/delete; 2 = partial; 1 = same forever; 0 = none.
- EX144 — Exclude. Student pastes a password into a finding — what do you do? Rubric: 3 = scrub, rotate, process finding; 2 = scrub only; 1 = ignore; 0 = publish.
Synthesis
Dossiers are verifiable, classified and boringly safe.
Continue studying — chapter 48 of 50
← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →