Evidence types reference
Every framework_mapping.json control lists one or more evidence_locators[]. Each locator has a type that tells the export engine which Ledgix subsystem produces the underlying artifact. This page enumerates every supported locator type.
Locator types available today
| Field | Type | Required | Description |
|---|---|---|---|
| events_jsonl | Per-day JSONL | Core | Ledger events in append-only JSONL, one file per day within the export window. The primary audit artifact. |
| policy_snapshots | JSON per version | Core | Signed policy versions active during the export window. Supports WHAT-policy-was-in-force-WHEN questions. |
| checkpoint_chain | JSONL | Core | Merkle checkpoint sequence anchoring ledger events. Supports tamper-evidence claims. |
| key_history | JSON | Core | Ed25519 signing-key lifecycle with attestation payloads. Supports signature chain-of-custody. |
| proof_index | JSONL | Core | Merkle inclusion index per event. Supports per-event inclusion proofs without re-computing the tree. |
| signatures | JSON | Core | Ed25519 manifest signatures. The root cryptographic attestation over the whole pack. |
| framework_mapping | JSON | Core | Control-to-evidence crosswalk for the selected framework. Human-readable by auditors. |
Locator types arriving by phase
These locator types are referenced by partial framework mappings today and will resolve to populated folders once their phase ships.
| Field | Type | Required | Description |
|---|---|---|---|
| incidents | Phase 2 | Planned | Structured incident records (detected_at, severity, root_cause, corrective_action). Unlocks OCC SR 11-7, EU AI Act Art. 61, SOX 302(a)(5). |
| model_cards | Phase 2 | Planned | Signed model cards with capability, limitation, and performance disclosures. Unlocks EU AI Act Art. 13(3), NIST RMF MAP-3. |
| dataset_sheets | Phase 2 | Planned | Dataset datasheets with provenance, quality checks, consent basis. Unlocks EU AI Act Art. 10, ISO 42001 clause 7. |
| bias_audits | Phase 3 | Planned | Per-protected-attribute approval-rate audits with 4/5ths rule + chi-square. Unlocks NYC LL144, EU AI Act Art. 10(2)(f)/(g). |
| impact_assessments | Phase 4 | Planned | AIA / DPIA / conformity assessments. Unlocks Colorado SB 205, Canada AIDA, GDPR Art. 35, EU AI Act Arts. 43/52. |
| dsr_records | Phase 5 | Planned | Data-subject requests with status, deadline, fulfillment evidence. Unlocks GDPR Arts. 15–22, CCPA §§1798.105/110/115/120. |
| processing_registers | Phase 5 | Planned | Records of Processing Activities per GDPR Art. 30. |
| retention_attestations | Phase 6 | Planned | Signed S3 Object Lock config attestations. Unlocks FINRA 17a-4, HIPAA §164.316. |
| phi_access_log | Phase 7 | Planned | Filtered view of events with PHI tags. Unlocks HIPAA §164.312(b). |
| baa_registry | Phase 7 | Planned | Business Associate Agreement registry with scope and expiry. Unlocks HIPAA §164.504(e). |
| minimum_necessary_attestations | Phase 7 | Planned | Per-agent minimum-necessary attestations. Unlocks HIPAA §164.502(b). |
| attestations | Phase 8 | Planned | Periodic signed attestation packets (quarterly AIUC-1, SOX 302/906). |
| marketing_claims | Phase 8 | Planned | Public AI claim registry with linked substantiation. Unlocks FTC Act §5. |
| training_data_lineage | Phase 9 | Planned | Training data provenance references per policy version. Unlocks EU AI Act Art. 10, NIST RMF MAP-3.1. |
How to read a framework_mapping.json
The file ships inside every evidence pack ZIP at the root. Its shape:
{
"framework": "eu_ai_act_article_12",
"version": "2024-08",
"schema_version": "v1",
"display_name": "EU AI Act — Article 12 (Automatic Record-Keeping)",
"controls": [
{
"control_id": "Art12(1)",
"title": "Automatic recording of events",
"description": "High-risk AI systems shall automatically record events ('logs') over the lifetime of the system.",
"evidence_locators": [
{ "type": "events_jsonl", "path_pattern": "events/*.jsonl" },
{ "type": "proof_index", "path": "event_proof_index.jsonl" }
]
}
]
}Auditors pick a control, read its evidence_locators[], open the referenced files inside the ZIP, and verify the control is satisfied. Every path is relative to the ZIP root.