<!-- SPDX-License-Identifier: Apache-2.0
<!-- Copyright (c) 2025 OrchIntel Systems Ltd.
<!-- https://orchintel.com | https://ioa.systems
<!--
<!-- Part of IOA Core (Open Source Edition). See LICENSE at repo root.
-->

# Evidence Verification Guide

## 1. Verify Signature (cosign)

```bash
# Download the evidence bundle and signature
curl -O https://cdn.orchintel.com/evidence/latest/evidence-realworld-10k.tar.gz
curl -O https://cdn.orchintel.com/evidence/latest/evidence-realworld-10k.tar.gz.sig
curl -O https://cdn.orchintel.com/evidence/latest/cosign.pub

# Verify the signature
cosign verify-blob \
  --key cosign.pub \
  --signature evidence-realworld-10k.tar.gz.sig \
  evidence-realworld-10k.tar.gz

# Expected output: "Verification for evidence-realworld-10k.tar.gz was successful."
```

## 2. Verify Checksum (SHA256)

```bash
# Download checksum file
curl -O https://cdn.orchintel.com/evidence/latest/evidence-realworld-10k.tar.gz.sha256

# Verify checksum
shasum -a 256 evidence-realworld-10k.tar.gz | diff - evidence-realworld-10k.tar.gz.sha256

# Expected output: No differences (silent success)
```

## 3. Extract and Inspect

```bash
# Extract the bundle
tar -xzf evidence-realworld-10k.tar.gz
cd realworld-10k

# Verify structure
ls -R

# Expected structure: README.md, METHODOLOGY.md, results/, artifacts/, compliance/
```

## 4. Reproduce Results (Optional)

```bash
# Clone IOA Core
git clone https://github.com/OrchIntel/ioa-core.git
cd ioa-core

# Checkout the same commit
git checkout <COMMIT_SHA_FROM_BUNDLE>

# Run validation
pytest tests/test_memory.py --real-world --requests 10000

# Compare results with bundle's results/summary.json
```

## 5. Audit Compliance Claims

Review the following files to audit specific compliance frameworks:
- `compliance/gdpr_validation.json` - GDPR compliance checks
- `compliance/hipaa_validation.json` - HIPAA compliance checks
- `compliance/iso27001_validation.json` - ISO 27001 compliance checks

Each file contains:
- Control ID
- Requirement description
- Evidence reference
- Pass/Fail status
- Auditor notes

---

**Questions?** Contact [email protected]