For AI agents: the complete documentation index is available at https://docs.flezise.com/llms.txt, the full documentation bundle is available at https://docs.flezise.com/llms-full.txt, and this page is available as Markdown at https://docs.flezise.com/administration/compliance-evidence.md.
Docs
  • 26.11

    • Compliance evidence

    A compliance evidence bundle is a signed archive of everything Flezise recorded about a run: the audit chain segment, the model call logs, the review and approval records, the gate results with their screenshots, and the delivery attribution. Export one when an auditor asks how a piece of AI-written work was produced, reviewed, and verified.

    Note

    Read this if you answer to audit or compliance. The audit trail is the live log; this page covers the exportable, signed snapshot of a slice of it.

    What is in the bundle

    The bundle is a .tar.gz covering one run or a project time window. It is a read-only aggregation of records the platform already keeps; nothing in it is produced after the fact.

    FileContents
    README.mdCover sheet mapping every section to EU AI Act Annex IV and ISO/IEC 42001:2023 control IDs, with the chain verification result at export time
    audit/chain-segment.jsonlThe hash-chained audit log entries covering the window
    audit/chain-verification.jsonThe live chain integrity check run at export time
    generation/logs.jsonlModel call records: model, tokens, PII flags. Prompt and response bodies appear as digests unless bodies are explicitly included
    approvals/reviews.jsonlReview actions with reviewer identity and timestamps
    approvals/approval-state.jsonThe approval state per artifact
    gates/gate-evidence.jsonPreflight results, acceptance criteria coverage, and browser verification verdicts
    gates/screenshots/One screenshot per acceptance criterion, captured during browser verification
    delivery/attribution.jsonPull request link, commit hashes, delivery status
    delivery/traceability.jsonSource-level attribution linking AI-written code to acceptance criteria
    manifest.json, signature.txtThe signed manifest and its detached ed25519 signature

    Every text file passes a secret and PII scan before the bundle is stored. When the scan finds anything, the export is blocked and nothing is written.

    The bundle is tenant-private. It is never listed on or synced to any marketplace.

    Export a bundle

    Open a run's timeline from the Evidence column on the runs page. The Compliance evidence panel has an Export evidence bundle button; each export produces a new version. The panel lists every bundle exported for the project with its scope, creation time, a chain badge (chain intact, or broken @N with the breaking sequence number), and a Download button.

    At export time the platform runs a live verification of the project's audit chain and records the result in the bundle. A broken chain does not block the export; the cover sheet states the break so the auditor sees it.

    Verify a bundle offline

    An auditor verifies a downloaded bundle without access to Flezise:

    swecli platform evidence verify bundle.tar.gz

    The verifier makes no API calls. It checks three independent properties: the ed25519 signature over the manifest, the content tree hash recorded in the manifest, and the continuity of the exported audit chain segment (gapless sequence numbers, each entry's hash linking to the previous one). Pass --pubkey with a base64 key or a key file to also pin the expected signer.

    The signing key

    Bundles are signed with the ed25519 key configured in EVIDENCE_SIGNING_KEY.

    Warning

    When EVIDENCE_SIGNING_KEY is empty, the platform generates a throwaway key per process and logs a warning. Bundles signed this way cannot be verified against a stable organizational key. Set the key before exporting evidence you intend to keep.

    Next steps

    • Audit trail: the live, hash-chained log the bundle draws from
    • Runs: where the run timeline and the export panel live
    • swecli platform: the CLI commands, including the offline verifier