# Durable Evidence Archive — Design & Verification Plan (DRAFT for approval)
Status: **PROPOSED — not yet provisioned.** No private evidence has been uploaded to any external
provider. `/app/evidence_intake` is treated as a working copy only and is excluded from the web root.

## Why this is needed
App/container storage is not a guaranteed-durable, access-controlled, backed-up system of record.
The master evidence archive must exist independently of the running website.

## Proposed structure (six separated areas)
1. `immutable-originals/` — write-once/object-lock; originals unmodified.
2. `working-review-copies/` — analysts' working copies.
3. `redaction-workspace/` — in-progress redactions.
4. `approved-public-derivatives/` — cleared, web-optimized derivatives only.
5. `manifests-and-integrity/` — master CSV/JSON manifests, SHA-256 lists, integrity reports.
6. `quarantine-unreviewed/` — confidential ZIP + unreviewed submissions.

## Controls required before it is called "secure"
- Encryption in transit (TLS) and at rest.
- Least-privilege IAM roles; MFA on admin accounts; access logging enabled.
- Object versioning + Object Lock (WORM) on `immutable-originals/`.
- Backup + tested restore; cross-region or offline copy.
- No public web access (bucket/container private; deny public ACLs).
- Integrity revalidation job (periodic SHA-256 recompute vs. manifest).
- Documented retention & deletion procedure.
- No secrets/tokens in source code or public config.

## Decisions REQUIRED from owner before provisioning
- Storage provider (e.g., AWS S3 + Object Lock, Backblaze B2, Google Cloud Storage, or a managed DMS).
- Account owner, administrators, and access roles.
- Authentication method (SSO/MFA), encryption keys (managed vs. customer-managed).
- Backup strategy, recovery procedure, retention policy, audit-log retention.
- Estimated budget; export/migration procedure; plan if Emergent hosting ends.
- Explicit authorization to transfer the private/confidential material to the chosen destination.

## Verification checklist to run AFTER approved setup (not yet performed)
Upload · readback · byte-size equality · SHA-256 equality · public-access denial ·
version recovery · backup/restore · audit-log entry present · export capability.
A durable-archive VERIFICATION REPORT will be produced from these results. The archive will not be
described as secure merely because a container was created.

## Interim integrity status (local working copy)
- Part 1 & Part 2 container SHA-256 re-verified and match the supplied values.
- Per-file SHA-256 preserved from the supplied manifests.
- Working copy is excluded from the public web server and from source control for evidence binaries.