{
  "manifest": {
    "version": "assurance-attestation/v1",
    "tenant_id": "naos-demo",
    "created_at": "2026-08-08T19:55:36Z",
    "file_hashes": {
      "incident.json": "sha256:7dec540a3be3cc08171bb0f168e251b9d5fe5e4b60861b7fee16f9b9f8781c7f",
      "control_state_at_T.json": "sha256:4dfbb4534f17f347e5e41fac2e0a1e5bd616fdb0ac3158d9f89ccf83763a73b4",
      "heartbeats.json": "sha256:a3338dd59d26529ee1f32576e943ec58eee4493d16d2907729db82155684c889",
      "framework_map.json": "sha256:ca91bfa65f031e2a365e7c64779cb2d0bfda3717d76d11888469175d51b7d802"
    },
    "qualified_timestamp": null
  },
  "manifest_hash": "sha256:5a0713296f5f689ffb2e9d6ae188632a4173c3621e45e2c57adb289eb2405236",
  "files": {
    "incident.json": {
      "case_id": "case-copilot-2026-0731-001",
      "attack_class": "sensitive_data_exposure",
      "agent": "microsoft-365-copilot",
      "decision": "block",
      "effect": "response_suppressed",
      "ts": "2026-07-31T14:03:22Z",
      "proof_manifest_hash": "sha256:9f2c\u2026(from agentic-proof-pack-unified/v1)",
      "policy_id": "pol-hr-out-of-scope",
      "policy_version": "v3"
    },
    "control_state_at_T.json": {
      "policy_id": "pol-hr-out-of-scope",
      "policy_version": "v3",
      "armed": true,
      "ts": "2026-07-31T14:03:22Z"
    },
    "heartbeats.json": [
      {
        "policy_id": "pol-hr-out-of-scope",
        "policy_version": "v3",
        "armed": true,
        "ts": "2026-07-31T14:00:22Z",
        "prev": null,
        "chain_hash": "sha256:10f42eb5dbdddfeaef722f16883b334d136866c8ced517d1f4f02a87e9dba46b",
        "sig": "hmac-sha256:94e330d7e3a4707506ac255e1c09cfce94fb5ee43a10d30528e759197b827392"
      },
      {
        "policy_id": "pol-hr-out-of-scope",
        "policy_version": "v3",
        "armed": true,
        "ts": "2026-07-31T14:01:22Z",
        "prev": "sha256:10f42eb5dbdddfeaef722f16883b334d136866c8ced517d1f4f02a87e9dba46b",
        "chain_hash": "sha256:e9ea32db748c6a670f8936cbb4b243bae365ecb755c04c820ae55a57758d9b77",
        "sig": "hmac-sha256:833946fb568f180331021898923ac378f8a1029aa47504eae21186a305be5eaf"
      },
      {
        "policy_id": "pol-hr-out-of-scope",
        "policy_version": "v3",
        "armed": true,
        "ts": "2026-07-31T14:02:22Z",
        "prev": "sha256:e9ea32db748c6a670f8936cbb4b243bae365ecb755c04c820ae55a57758d9b77",
        "chain_hash": "sha256:be6ace4b16a1520e5c5e5c555ab83a68c60599e7995bfd7a731c356fcf731f7f",
        "sig": "hmac-sha256:21c8c8ffbaa4843b77816439604e847f74f0c27a5b03c9bb77e20105121afeaa"
      },
      {
        "policy_id": "pol-hr-out-of-scope",
        "policy_version": "v3",
        "armed": true,
        "ts": "2026-07-31T14:03:22Z",
        "prev": "sha256:be6ace4b16a1520e5c5e5c555ab83a68c60599e7995bfd7a731c356fcf731f7f",
        "chain_hash": "sha256:c076f27fb8692e3eaad0eac4769b44f5b80fd478fefd018de438c745fa003bf5",
        "sig": "hmac-sha256:9b17c825fb4bbe198ede3b80b99676cb26b5d7205ac0e4a278aaa58dc3be994c"
      },
      {
        "policy_id": "pol-hr-out-of-scope",
        "policy_version": "v3",
        "armed": true,
        "ts": "2026-07-31T14:04:22Z",
        "prev": "sha256:c076f27fb8692e3eaad0eac4769b44f5b80fd478fefd018de438c745fa003bf5",
        "chain_hash": "sha256:5951a88ffca06bd40e9bc2e2e06321911cce9b2297ff509db5db564f4ecc1ed3",
        "sig": "hmac-sha256:a006f3e8b9334815681ff89c78a54e6fa8347028d7470c81dc6d2364fff78098"
      },
      {
        "policy_id": "pol-hr-out-of-scope",
        "policy_version": "v3",
        "armed": true,
        "ts": "2026-07-31T14:05:22Z",
        "prev": "sha256:5951a88ffca06bd40e9bc2e2e06321911cce9b2297ff509db5db564f4ecc1ed3",
        "chain_hash": "sha256:5e24e96e1146cc4222f838901b2261b8d50e061e1f1cd88de5dc7f732381dcea",
        "sig": "hmac-sha256:e0eee3c18838b5ce0340e2787cbe2a1e9ad3b42db42be12b953e1cab42ddfef6"
      },
      {
        "policy_id": "pol-hr-out-of-scope",
        "policy_version": "v3",
        "armed": true,
        "ts": "2026-07-31T14:06:22Z",
        "prev": "sha256:5e24e96e1146cc4222f838901b2261b8d50e061e1f1cd88de5dc7f732381dcea",
        "chain_hash": "sha256:8c6c87d4eddbc84b7aaca3fedbe8558c0d7c4e50547c4fd925430dd7397ecb3d",
        "sig": "hmac-sha256:fc065168dcbebf599ae2ac0091506178c9498368c6bba72792df478890235ac0"
      }
    ],
    "framework_map.json": {
      "eu_ai_act_art12": "record-keeping obligation satisfied by this attestation",
      "iso_42001_A.8.4": "operational monitoring evidence"
    }
  },
  "signature": "hmac-sha256:7e2ec0a1f003dc5450f3ef7f29c7f67a99f766bc21640e8abb95b22b799d97ea",
  "asym_signature": {
    "alg": "ed25519",
    "signature": "5TNThW7p/zr6wDXuqFrqa5pB6gDtWPF0Ab4/Ymi7/+pNrrLRyvIODu/VSwzCUyHWjz/nA7YRtyGQbHVFSEp5Bg==",
    "public_key_raw": "kqfcPScZwqBmSSOugMJmJsohMhcpmpYwrKZHP8pvYrU=",
    "public_key_spki": "MCowBQYDK2VwAyEAkqfcPScZwqBmSSOugMJmJsohMhcpmpYwrKZHP8pvYrU="
  },
  "timestamp_token": {
    "token_b64": "MIISHzADAgEAMIISFgYJKoZIhvcNAQcCoIISBzCCEgMCAQMxDzANBglghkgBZQMEAgMFADCCAZAGCyqGSIb3DQEJEAEEoIIBfwSCAXswggF3AgEBBgQqAwQBMDEwDQYJYIZIAWUDBAIBBQAEIFoHEylvX2if+y6dauGIYypBc8NiHkXixXrbKJ6yQFI2AgQG2hmUGA8yMDI2MDgwODE5NTUzNloBAf8CCByFeV5y6DXtoIIBE6SCAQ8wggELMREwDwYDVQQKDAhGcmVlIFRTQTEMMAoGA1UECwwDVFNBMXYwdAYDVQQNDG1UaGlzIGNlcnRpZmljYXRlIGRpZ2l0YWxseSBzaWducyBkb2N1bWVudHMgYW5kIHRpbWUgc3RhbXAgcmVxdWVzdHMgbWFkZSB1c2luZyB0aGUgZnJlZXRzYS5vcmcgb25saW5lIHNlcnZpY2VzMRgwFgYDVQQDDA93d3cuZnJlZXRzYS5vcmcxJDAiBgkqhkiG9w0BCQEWFWJ1c2lsZXphc0BtYWlsYm94Lm9yZzESMBAGA1UEBwwJV3VlcnpidXJnMQswCQYDVQQGEwJERTEPMA0GA1UECAwGQmF5ZXJuoIIOZzCCBmAwggRIoAMCAQICCQDC6YYWDajpzTANBgkqhkiG9w0BAQ0FADCBlTERMA8GA1UEChMIRnJlZSBUU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEiMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3VlcnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFMB4XDTI2MDIxNTE5NDQyMloXDTQwMDIwMjE5NDQyMlowggELMREwDwYDVQQKDAhGcmVlIFRTQTEMMAoGA1UECwwDVFNBMXYwdAYDVQQNDG1UaGlzIGNlcnRpZmljYXRlIGRpZ2l0YWxseSBzaWducyBkb2N1bWVudHMgYW5kIHRpbWUgc3RhbXAgcmVxdWVzdHMgbWFkZSB1c2luZyB0aGUgZnJlZXRzYS5vcmcgb25saW5lIHNlcnZpY2VzMRgwFgYDVQQDDA93d3cuZnJlZXRzYS5vcmcxJDAiBgkqhkiG9w0BCQEWFWJ1c2lsZXphc0BtYWlsYm94Lm9yZzESMBAGA1UEBwwJV3VlcnpidXJnMQswCQYDVQQGEwJERTEPMA0GA1UECAwGQmF5ZXJuMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEohXhobLWy4cYsdKOFALpjUsB1FJTntwwb7PH2LOfNMAA1ufaKhkgsdeW6etU0pl5MC5tSVuPF52yy4sz+mbY3L7IVdx/bs9m0ud7IA14YNcC2yIQLa2gvnxwsrR3rlWro4IB5jCCAeIwCQYDVR0TBAIwADAdBgNVHQ4EFgQUFcC9JuvUXYLRXZMmMS/vcLKLRl4wHwYDVR0jBBgwFoAU+lUNjDRmUUNM9+ezp2yVr3rmpJcwCwYDVR0PBAQDAgbAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMGwGCCsGAQUFBwEBBGAwXjAzBggrBgEFBQcwAoYnaHR0cDovL3d3dy5mcmVldHNhLm9yZy9maWxlcy9jYWNlcnQucGVtMCcGCCsGAQUFBzABhhtodHRwOi8vd3d3LmZyZWV0c2Eub3JnOjI1NjAwNwYDVR0fBDAwLjAsoCqgKIYmaHR0cDovL3d3dy5mcmVldHNhLm9yZy9jcmwvcm9vdF9jYS5jcmwwgcgGA1UdIASBwDCBvTCBugYDKwUIMIGyMDMGCCsGAQUFBwIBFidodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZyZWV0c2FfY3BzLmh0bWwwMgYIKwYBBQUHAgEWJmh0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMucGRmMEcGCCsGAQUFBwICMDsaOUZyZWVUU0EgdHJ1c3RlZCB0aW1lc3RhbXBpbmcgU29mdHdhcmUgYXMgYSBTZXJ2aWNlIChTYWFTKTANBgkqhkiG9w0BAQ0FAAOCAgEAazFUv2H53zK9M4mZ3rAVDqwzUazTYLdyIDDQ8DYcJeqClh1SIZWJzP+W6JY326WUwG6r8RyN87U9P7MMUDqk2reagSUQGP1R9Z/0+DPbg40rrt6n4dGR+Ty/RDaqFVuOIuTU/850Hr9jBlzgB8M/ZGcMM8/TBV+oWxoQalmvp5QKm+2O9ihc4995tTlR8VdlpeGA/X/dW2UxaVBBluCrW5JsaX/4hiD2n+Fh6aAVvzuhM6HzCmJc+Ml8hAYdMEUVcl5bS64/jBR6oXvj7DAZZav3QmjuFvxfgLhxJbu2lGFjAEnpaYVgCYlLDTK+RwKHgkkoIpan9QkqFgvpOnuN9+BcpviMuHLDHsfjxuK0nalyVUPgFhHUWo0jyoe8g36TZHZzusqkCf7UnddV0OXC9DPY1rgg9cx5YAPrvkdnK8t8qNt4w+6kxi4WalL1wslooB99P0P0V44w8K3OAyYkPoEWNBYXU2Kpb4DAT6+C3CSpzZLIr3Y/pG8+21Um6wQM0YmsyvZfONf+VzLT/Qbw9ISgqUBbz/T0oAgvBEJyqoEntuhUiQWgEHAOU5yvDReI5GxJQcX/88oez9yIx7KN+Y7YFFg9f4rYPQSVm2FMCeLXyC6QdhdMG5NRnGQwg2aMlt1397awKc/2Xfd4Bd46HPR4fURb3ikc1kO3XVLd3oEwggf/MIIF56ADAgECAgkAwemGFg2o6YAwDQYJKoZIhvcNAQENBQAwgZUxETAPBgNVBAoTCEZyZWUgVFNBMRAwDgYDVQQLEwdSb290IENBMRgwFgYDVQQDEw93d3cuZnJlZXRzYS5vcmcxIjAgBgkqhkiG9w0BCQEWE2J1c2lsZXphc0BnbWFpbC5jb20xEjAQBgNVBAcTCVd1ZXJ6YnVyZzEPMA0GA1UECBMGQmF5ZXJuMQswCQYDVQQGEwJERTAeFw0xNjAzMTMwMTUyMTNaFw00MTAzMDcwMTUyMTNaMIGVMREwDwYDVQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZyZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIwEAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2Ao4OMDLxERDZZM2pS50CeOGUKukTqqWZB82ml5OZW9msfjO62f43BNocAamNIa/j9ZGlnXBncFFnmY9QFnIuCrRish9DkXHSz8xFk/NzWveUpasxH2wBDHiY3jPXXEUQ7nb0vR0UmM8X0wPwal3Z95bMbKm2V6Vv4+pP77585rahjT41owzuX/Fw0c85ozPT/aiWTSLbaFsp5WG+iQ8KqEWHOy6Eqyarg5/+j63p0juzHmHSc8ybiAZJGF+r7PoFNGAKupAbYU4uhUWC3qIib8Gc199SvtUNh3fNmYjAU6P8fcMoegaKT/ErcTzZgDZm6VU4VFb/OPgCmM9rk4VukiR3SmbPHN0Rwvjv2FID10WLJWZLE+1jnN7U/4ET1sxTU9JylHPDwwcVfHIqpbXdC/stbDixuTdJyIHsYAJtCJUbOCS9cbrLzkc669Y28LkYtKLI/0aU8HRXry1vHPglVNF3D9ef9dMU3NEEzdyryUE4BW388Bfn64Vy/VL3AUTxiNoF9YI/WN0GKX5zh77S13LBPagmZgEEX+QS3XCYbAyYe6c0S5A3OHUW0ljniFtR+JaLfyYBITvEy0yF+P8LhK9qmIM3zfuBho9+zzHcpnFtfsLdgCwWcmKeXABSyzV90pqvxD9hWzsf+dThzgjHHHPh/rt9xWozYhMp6e1sIwIDAQABo4ICTjCCAkowDAYDVR0TBAUwAwEB/zAOBgNVHQ8BAf8EBAMCAcYwHQYDVR0OBBYEFPpVDYw0ZlFDTPfns6dsla965qSXMIHKBgNVHSMEgcIwgb+AFPpVDYw0ZlFDTPfns6dsla965qSXoYGbpIGYMIGVMREwDwYDVQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZyZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIwEAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREWCCQDB6YYWDajpgDAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vd3d3LmZyZWV0c2Eub3JnL3Jvb3RfY2EuY3JsMIHPBgNVHSAEgccwgcQwgcEGCisGAQQBgfIkAQEwgbIwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMuaHRtbDAyBggrBgEFBQcCARYmaHR0cDovL3d3dy5mcmVldHNhLm9yZy9mcmVldHNhX2Nwcy5wZGYwRwYIKwYBBQUHAgIwOxo5RnJlZVRTQSB0cnVzdGVkIHRpbWVzdGFtcGluZyBTb2Z0d2FyZSBhcyBhIFNlcnZpY2UgKFNhYVMpMDcGCCsGAQUFBwEBBCswKTAnBggrBgEFBQcwAYYbaHR0cDovL3d3dy5mcmVldHNhLm9yZzoyNTYwMA0GCSqGSIb3DQEBDQUAA4ICAQBor36/k4Vi70zrO1gL4vr2zDWiZ3KWLz2VkB+lYwyH0JGYmEzooGoz+KnCgu2fHLEaxsI+FxCO5O/Ob7KU3pXBMyYiVXJVIsphlx1KO394JQ37jUruwPsZWbFkEAUgucEOZMYmYuStTQq64imPyUj8Tpno2ea4/b5EBBIex8FCLqyyydcyjgc5bmC087uAOtSlVcgP77U/hed2SgqftK/DmfTNL1+/WHEFxggc89BTN7a7fRsBC3SfSIjJEvNpa6G2kC13t9/ARsBKDMHsT40YXi2lXft7wqIDbGIZJGpPmd27bx+Ck5jzuAPcCtkNy1m+9MJ8d0BLmQQ7eCcYZ5kRUsOZ8Sy/xMYlrcCWNVrkTjQhAOxRelAuLwb5QLjUNZm7wRVPiudhoLDVVftKE5HU80IK+NvxLy1925133OFTeAQHSvF15PLW1Vs0tdb33L3TFzCvVkgNTAz/FD+eg7wVGGbQug8LvcR/4nhkF2u9bBq4XfMl7fd3iJvERxvz+nPlbMWR6LFgzaeweGoewErDsk+i4o1dGeXkgATV4WaoPILsb9VPs4Xrr3EzqFtS3kbbUkThw0ro025xL5/ODUk9fT7dWGxhmOPsPm6WNG9BesnyIeCv8zqPagse9MAjYwt2raqNkUM4JezEHEmluYsYHH2jDpl6uVTHPCzYBa/amTGCAewwggHoAgEBMIGjMIGVMREwDwYDVQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZyZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIwEAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUCCQDC6YYWDajpzTANBglghkgBZQMEAgMFAKCBuDAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MDgwODE5NTUzNlowKwYLKoZIhvcNAQkQAgwxHDAaMBgwFgQUSB/VPFNNOEGAwChlGaA2+YhUR2YwTwYJKoZIhvcNAQkEMUIEQHYwWO2c+iZLpsDtEOOGpDP7CpwOprUmfHXWLsjphTWe5FKuYpJq0TFexjA2szkVGJ9GziwXo9V8KC2Wfw+EfgMwCgYIKoZIzj0EAwQEZzBlAjBISuQL2FwGqlKYOPBFxMGtOI03As3rz9WOxCbh873Ee4bxw6q20192xVIyDvQNPR0CMQDASSqvhGOg10FVV24pU0mpQb6j/C5vWOSFZNzClw1Ti/E+ei9GCtieUNRU90t3p2s=",
    "gen_time": "2026-08-08T19:55:36Z",
    "tsa_url": "https://freetsa.org/tsr"
  },
  "_note": "SAMPLE / illustrative incident \u2014 not a real customer. Signing key is a demo Ed25519 key."
}