The Evidence Store You Can Defend

The question a store must survive

Module 3’s collectors produce artifacts; those artifacts will be read months later by a professional skeptic asking one question: why should I believe this evidence is what was collected, unaltered? This lesson is about answering that question with architecture — and about the most instructive design decision in this training’s reference material: a store whose builders built cryptographic signing, then removed it. On purpose. Understanding why they were right (and when they’d be wrong) gives you the rule for every integrity decision you’ll make in federal delivery.

The mechanics: address by content, never rewrite, carry provenance

CONTENT ADDRESSING   every evidence blob stored under its SHA-256; the
                     address IS the integrity check - a modified artifact
                     is a DIFFERENT address, not a changed file

WORM POINTERS        append-only run records point at blob addresses;
                     runs are added, never edited; blob immutability
                     enforced by the storage platform's write-once mode

PROVENANCE DIGESTS   each run record carries: catalog version hash (which
                     rules), collector version hash (which instrument),
                     collection window (when) - the full recipe to say
                     WHAT produced this evidence

RBAC                 writers can append; nobody in the workflow can
                     rewrite; reads are logged

Together: any artifact can be re-hashed against its address, any run can name its exact inputs, and tampering requires rewriting history the platform is configured to refuse. Note what’s absent — no signatures anywhere.

The unsigned decision, defended

The builders had a working RS256-and-Merkle-tree stack. They removed it, and their reasoning is the lesson. Within one system boundary, signing added: key management (rotation, protection, and the awkward question of whose key — the collector service signing its own output is a rubber stamp), verification tooling nobody ran, and a false sense that cryptography had closed gaps it hadn’t. What it defended against — tampering by someone with write access — was already defended by content addressing plus platform-enforced immutability plus RBAC, because when the signing keys live in the same admin domain as the store, the platform’s controls and the signature’s guarantee reduce to the same trust anchor: the platform’s own configuration. (A separately-custodied key — an HSM another team holds, an external timestamping witness — IS a different anchor, and buys real independence at real operational cost; that trade, not signing-is-always-better, is the actual decision. And check your baseline first: some control enhancements at higher baselines mandate cryptographic mechanisms for specific artifact classes regardless of your architecture’s elegance — the governing requirement gets established before the trust-model argument starts.)

And here’s what makes the design defensible rather than merely simple: they documented their own TOCTOU window — the interval between a collector reading a source system and the blob landing immutable, during which a compromised collector could store falsehood with a perfectly valid hash. No signature fixes that either (a compromised collector signs its lies). The documentation says: we know this window exists, here is its size, here are the compensations. That honesty — naming the gap your controls do not close — is worth more to an assessor than ceremony that pretends to close it. It’s Lesson 3.1’s warts-said-out-loud principle, applied to your own trust model.

The boundary rule

So when does signing earn its cost? The rule that reconciles this lesson with everything Module 5 will do:

Integrity guarantees are scoped to trust boundaries. Within one boundary — one platform, one RBAC regime, one operator — content addressing plus platform immutability plus a documented threat model can suffice, and signing often adds cost without adding trust. The moment an artifact CROSSES a boundary — to another organization, another network, another side of a cross-domain gate — the receiver shares none of your platform’s guarantees, and hardened, signed (or independently verifiable) artifacts become the requirement.

Hold that rule. When Lesson 5.2 sends packages across an air gap using verification chains and structural controls, it’s the same rule from the other side — the boundary is exactly where “the platform enforces it” stops being an answer the receiver can accept.

Prompt first: audit your own store against the model

Audit our evidence storage (bucket config, IAM, and the collector
pipeline code) against the defensible-store model:
1) content addressing: are artifacts stored under content hashes, and
   does anything re-verify address-vs-content on read?
2) immutability: is write-once enforced by PLATFORM configuration
   (show the setting) or by convention (a policy doc saying dont)?
3) provenance: does each run record carry rule-version, instrument-
   version, and collection-window digests? list what is missing;
4) TOCTOU honesty: write the paragraph WE should publish - the window
   between source-read and immutable-write, its duration, and existing
   compensations. Do not soften it.
5) verdict per item: PLATFORM-ENFORCED / CONVENTION / ABSENT.

The convention-vs-platform column is where these audits earn their keep: most stores turn out to be immutable the way a hallway is clean — because nobody has messed with it yet.

Key takeaway

Defend evidence with architecture: content addressing (the hash is the integrity check), platform-enforced WORM, provenance digests naming rules-instrument-window, RBAC — and a written trust model that names its own TOCTOU window instead of ceremonializing past it. Signing is not virtue; it’s a boundary tool: within one platform’s trust regime it often adds cost without trust, but artifacts that cross boundaries need independent verifiability — the rule Lesson 5.2 picks up at the air gap. Next: turning all of this into documents an AO can actually read.