Evidence pack

Evidence pack format

A scan evidence pack is an export-safe summary of package findings, source freshness, review pressure, and Canada-readiness checks. It never contains uploaded file contents, but package names and versions can still reveal private architecture.

Core fields

schema_versionVersion of the evidence-pack shape.

generated_at, file_name, package_countAudit metadata without storing the uploaded file body.

audit_mode, upstream_status, freshnessWhether fresh upstream evidence was checked, partial, unavailable, or registry-only.

packagesPer-package registry verdict, effective verdict, advisories, package-health signals, and source statuses.

canada_readinessRelease-readiness checks and next step wording. This is not certification.

evidence_events, review_proposalsFresh evidence movement and proposed human-review actions generated by the scan.

privacy_noticeReminder that dependency metadata can be sensitive even when raw uploaded files are excluded.

How to use it

The JSON pack is the canonical structured export for automation and repeat review. The browser can generate a Markdown copy from that JSON for human tickets. Treat both as evidence snapshots that should be regenerated before release, and do not publish them until the dependency list is safe to disclose.