{
  "format": "helmgate.evidence-bundle",
  "version": 1,
  "caseRef": "LAB-2026-0007",
  "organisation": "ITSailor internal lab tenant",
  "tenantId": "itsailor-internal-lab",
  "requestId": "lab-compromise-0007",
  "algorithm": {
    "hash": "sha256",
    "encoding": "hex",
    "genesis": "hoist:evidence:genesis:v1",
    "fieldSeparator": "U+0000",
    "entryHashFields": [
      "prevHash",
      "eventId",
      "tenantId",
      "requestId",
      "actorId",
      "eventType",
      "actionId",
      "connectorKey",
      "policyOutcome",
      "payloadHash",
      "createdAt"
    ],
    "absentFieldEncoding": "empty string",
    "payloadHash": {
      "hash": "sha256",
      "encoding": "hex",
      "canonicalJson": [
        "Object keys sorted ascending by UTF-16 code point, not by locale collation.",
        "Keys whose value is undefined are omitted.",
        "No whitespace between tokens; JSON.stringify semantics for strings, numbers, booleans and null.",
        "Arrays keep their order.",
        "Non-finite numbers are refused rather than encoded."
      ]
    }
  },
  "proves": [
    "No event in this bundle was edited after it was written: an edited field changes its entryHash.",
    "No event was deleted or reordered: each entry binds the hash of the one before it.",
    "The payload behind each event is the one whose SHA-256 is recorded here, for anyone holding it."
  ],
  "doesNotProve": [
    "Who produced this bundle. A hash chain is self-referential; it carries no signature and no external anchor, so a consistent chain can be fabricated by anyone able to run SHA-256.",
    "That the events describe what happened in Microsoft 365. The chain records what the engine did; the tenant's own audit log is the independent corroboration.",
    "That no event is missing from AFTER the last one. Verification is anchored at the format genesis, so nothing can be removed from the front, but a chain truncated at its head verifies as a shorter chain. Compare the event count and head hash against the copy you were sent."
  ],
  "events": [
    {
      "seq": 0,
      "eventId": "lab-compromise-0007-evt-0",
      "tenantId": "itsailor-internal-lab",
      "requestId": "lab-compromise-0007",
      "actorId": "lab-operator-1",
      "eventType": "action_planned",
      "actionId": "graph.session.revoke",
      "connectorKey": "microsoft-graph-write",
      "policyOutcome": null,
      "payloadHash": "34a216bbc2620b3eafe726138fcdd870a50aa0eb0ec46c1da0e89d4f0294a9e9",
      "createdAt": "2026-08-12T07:14:02.000Z",
      "prevHash": "hoist:evidence:genesis:v1",
      "entryHash": "4702390edb2f3f6baee6c6165f355af76ea65b4e146cb0189df50946c25b76d1"
    },
    {
      "seq": 1,
      "eventId": "lab-compromise-0007-evt-1",
      "tenantId": "itsailor-internal-lab",
      "requestId": "lab-compromise-0007",
      "actorId": "lab-operator-1",
      "eventType": "policy_decided",
      "actionId": "graph.session.revoke",
      "connectorKey": "microsoft-graph-write",
      "policyOutcome": "requires_approval",
      "payloadHash": "efd7c26b822b584ad29c357de933dbfee4523224aeaf6f593f74d8561ac8c05a",
      "createdAt": "2026-08-12T07:14:02.000Z",
      "prevHash": "4702390edb2f3f6baee6c6165f355af76ea65b4e146cb0189df50946c25b76d1",
      "entryHash": "e9ee874584061b0709f13e85f2dd0ad7e72c689b6ec72297a7576c070372c6d6"
    },
    {
      "seq": 2,
      "eventId": "lab-compromise-0007-evt-2",
      "tenantId": "itsailor-internal-lab",
      "requestId": "lab-compromise-0007",
      "actorId": "lab-operator-1",
      "eventType": "approval_requested",
      "actionId": "graph.session.revoke",
      "connectorKey": "microsoft-graph-write",
      "policyOutcome": null,
      "payloadHash": "c75792737c7c823bb72e2108f150ccf2945649f98b0f8dde62da6e3ab7f8be6c",
      "createdAt": "2026-08-12T07:14:03.000Z",
      "prevHash": "e9ee874584061b0709f13e85f2dd0ad7e72c689b6ec72297a7576c070372c6d6",
      "entryHash": "fdaf0fc4ca89d0a97f52cc75d71ec7fadd80e4fde70a3af97054876f17040a49"
    },
    {
      "seq": 3,
      "eventId": "lab-compromise-0007-evt-3",
      "tenantId": "itsailor-internal-lab",
      "requestId": "lab-compromise-0007",
      "actorId": "lab-operator-2",
      "eventType": "approval_granted",
      "actionId": "graph.session.revoke",
      "connectorKey": "microsoft-graph-write",
      "policyOutcome": null,
      "payloadHash": "ac2733079088ff57e12624895c318cb70195eb2fe21ce99f9c8d20237456ea28",
      "createdAt": "2026-08-12T07:19:48.000Z",
      "prevHash": "fdaf0fc4ca89d0a97f52cc75d71ec7fadd80e4fde70a3af97054876f17040a49",
      "entryHash": "ca46f2519d6736fdbc8045ce4e4a4feb499bc26ec02bfdd578422660fdaa1226"
    },
    {
      "seq": 4,
      "eventId": "lab-compromise-0007-evt-4",
      "tenantId": "itsailor-internal-lab",
      "requestId": "lab-compromise-0007",
      "actorId": "lab-operator-1",
      "eventType": "action_executed",
      "actionId": "graph.session.revoke",
      "connectorKey": "microsoft-graph-write",
      "policyOutcome": null,
      "payloadHash": "13ff1ebeb02f8fdd0221ace33c4eb461198f9fc46c043689e1834e563916299c",
      "createdAt": "2026-08-12T07:19:50.000Z",
      "prevHash": "ca46f2519d6736fdbc8045ce4e4a4feb499bc26ec02bfdd578422660fdaa1226",
      "entryHash": "d6c97d78171a3fde75b560cd10c04cf3791df6dbb92d0f347d46dc255775b782"
    }
  ],
  "headHash": "d6c97d78171a3fde75b560cd10c04cf3791df6dbb92d0f347d46dc255775b782",
  "howToVerify": [
    "Save this JSON to a file, for example evidence-bundle.json.",
    "Run: node helmgate-verify-evidence-bundle.mjs evidence-bundle.json",
    "The verifier is a single file with no dependencies beyond Node itself, and it contacts nothing. It recomputes every entryHash from the fields in this bundle and reports the first link that does not hold.",
    "You do not have to use ours. algorithm.entryHashFields is the exact join order, separated by a NUL byte, hashed with SHA-256 and rendered as lowercase hex, starting from algorithm.genesis. Fifteen lines in any language reproduces it."
  ]
}