Softilo Assure evidence pack
============================
Organisation: Harbour & Finch Accountants Ltd
Scan:         #2 collected 2026-11-06T09:55:02.368457+00:00
Ledger head:  5559b278afbaf203d8d0bf1ea2e7f0ea1784dd1be1ef8ec2b182987596407af4
Timestamps:   none: this pack cannot rule out a complete rewrite

WHAT THIS PACK CAN PROVE

Every check verdict, the digest of the raw snapshot and every attestation is recorded in
ledger.jsonl. Each entry's hash is SHA-256(previous hash + canonical JSON body).

* The chain alone shows the ledger is consistent. It does NOT stop whoever holds the ledger
  rewriting every entry and recomputing every hash.
* anchors.jsonl holds timestamps from an independent authority over the ledger's head. They
  show the ledger existed in this form at those times, so a later rewrite would not match.
* Neither shows that the facts were true when collected. They show only that the records
  have not changed since they were fixed.
* report.html and the CSV files are convenience views and are not covered by the ledger.
* A timestamp authority cannot tell if two different histories were both timestamped. Keep
  the ledger head above: a later pack must contain that same hash.

TO VERIFY

Download the root certificate from the timestamp authority itself, not from this pack:

    python verify.py ledger.jsonl --tsa-ca TSA_ROOT.pem

Exit code 0 means verified, 1 means failed and 2 means inconclusive. Without --tsa-ca, or
without timestamps covering every entry, the best possible result is inconclusive.
