Evidence package

One signed ZIP per Deployment or Data Change with everything an auditor asks for — and the consolidated report of the change as a PDF.

Downloading it

Open the Deployment or Data Change and choose Evidence package in its ⋮ menu. The package is assembled on the spot from the same data the screen shows, so the two can never tell different stories.

  • Available to roles that include “Download the audit evidence package of a Deployment or Data Change”.
  • Download PDF, in the same menu, gives the consolidated report of the change on its own.
  • Every download is recorded in the audit log, with the fingerprint of the package it produced.

What it contains

  • ChangeRequest.pdf: the consolidated report — phase progress, people, schedule, approvals, tests, development, validations, evidence and history.
  • BusinessCase.pdf and Requirements.pdf: the business case and the requirements the change comes from.
  • PullRequests.pdf and Commits.pdf: the code behind the change and its CI runs, from GitHub, GitLab or Azure DevOps.
  • TestResults.pdf, the committee minutes of a Deployment or the authorizations of a Data Change, and the rollback plan.
  • Validations: the PDF of every checklist related to the change.
  • The attachments, in folders by phase, plus AuditTrail.csv with every recorded change. 
PAGOS-DPY-2026-00482-AUDIT/
├── ChangeRequest.pdf
├── BusinessCase.pdf · Requirements.pdf
├── PullRequests.pdf · Commits.pdf · TestResults.pdf
├── Committee-PRE.pdf · Committee-PROD.pdf
├── Rollback-Plan.pdf · DataChanges.pdf
├── Validations/  PRE-Evidence/  PROD-Evidence/  Other-Evidence/
├── AuditTrail.csv · README.txt
└── Manifest.sha256 · Manifest.sig · SigningKey.pem

Integrity and verification

Manifest.sha256 lists the SHA-256 of every other file and Manifest.sig signs it with an Ed25519 key; the public key travels in the package and is also published at /.well-known/devgob-evidence-key. Each attachment is checked against the fingerprint recorded when it was uploaded — one that no longer matches is left out and listed, never packaged silently.

sha256sum -c Manifest.sha256
openssl pkeyutl -verify -pubin -inkey SigningKey.pem \
  -rawin -in Manifest.sha256 -sigfile Manifest.sig
The package documents evidence for your own audit and control mapping; it is not a certification.

Limits

  • Up to 200 attachments and 64 MB per package; anything beyond is listed in README.txt.
  • Up to ten packages every ten minutes per person, so assembling one never slows the workspace down.

Next steps

Deployment governance How a code release travels to production: its phases, the evidence each one asks for, two committee authorizations, and an automatic response to a rollback. Data changes Changes to production data get their own governed flow, with business and technical authorization kept apart. Security and data isolation How one workspace's information stays that workspace's information.