# Evidence package — Audit Chain Integrity

**Claim supported:** A retroactive migration (`20260507c`) updated two *label* columns on historical
CrewOS audit events; an audit-chain verifier flagged it (20 mismatches, 1,142 broken links); the
investigation showed the touched columns were **outside the hashed payload** so chain integrity was
intact; and the response was promoted into a fleet-wide operating standard plus Caliber criterion
**C49**, with red/green fixtures. (Articles: foundational *"When a CrewOS failure became a fleet-wide
control"*; technical companion §10.)

**Claim IDs:** E1-C001, E1-C002, E1-C003, E1-C004
**Evidence level:** fleet-codified (installed → enforced → exercised → outcome → fleet-codified)
**Access classification:** Sanitized public excerpt

## What this package proves, and what it does not

**Proves:** the payload boundary is real and checkable (`payload-boundary.sql` — 15 hashed columns,
labels absent); the discipline exists as canonical doctrine (`audit-chain-integrity-standard.md`); the
rule is mechanically enforced (`c49-contract.md`); and the enforcement is tested across allowed,
forbidden, warned, and grandfathered cases (`c49-fixture-matrix.md`).

**Does not prove:** that the verifier's specific run counts (20 / 1,142) can be re-executed from this
package — that run was against the `foundryos-test` sandbox on 2026-05-01 and is recorded in internal
governance docs, not reproducible here. It also makes no claim about any production customer data: the
affected rows were sandbox-only and were swept on tear-down.

## Source

- **Source date:** 2026-05-01 (incident + codification); package built 2026-08-02.
- **Source commit:** `24ec65306` (FoundryOS monorepo).
- **Original internal locations:** `docs/OPERATING_STANDARDS.md § Audit Chain Integrity Discipline`;
  `system/caliber/lib/c49-audit-chain-integrity.mjs`; `system/core/scripts/002_audit_events.sql`;
  `system/caliber/lib/__fixtures__/c49/`. The raw incident migration lives in the `apps/crewos`
  submodule history (added `6acca38b`/`8cbf74af`, archived in baseline-squash `514dba68`) and is
  **Internal evidence only**.

## Redaction statement

No secrets, credentials, private URLs, or customer/staff/tenant identifiers appear in these artifacts.
The sources are framework scaffold SQL, scanner logic, fleet doctrine, and synthetic test fixtures.
The one incident-specific identifier retained — the `foundryos-test` sandbox account name — is an
internal test account, not a customer tenant, and is load-bearing for the claim (it establishes that
no production data was involved). See `manifest.json` → `redactions`.

## Reproduction

- Payload boundary: read `system/core/scripts/002_audit_events.sql` and confirm the 15-field
  `v_payload` excludes `entity_label_snapshot` / `actor_label`.
- Enforcement: run `node system/caliber/lib/c49-audit-chain-integrity.mjs` against the fixtures in
  `system/caliber/lib/__fixtures__/c49/` and confirm the PASS/FAIL/WARN/INFO matrix.
- Standard: `docs/OPERATING_STANDARDS.md § Audit Chain Integrity Discipline`.