Reshot

Evidence Packs

An accessibility conformance evidence pack is a deterministic .reshot-pack containing one approved revision and the exact retained bytes linked to its criterion decisions. A recipient can inspect it without a Reshot account or a callback to Reshot.

What the conformance pack contains

  • canonical record/conformance.json for the approved revision
  • every selected evidence artifact with content address and provenance
  • a verification report stating the pack's limits
  • an inventory of every path, role, media type, SHA-256 hash, and byte size
  • the conformance template hash, record hash, statement identity, and revision
  • a content commitment bound to an RFC-3161 timestamp response
  • an Ed25519 origin signature and independently verifiable signer registry
  • a second timestamp binding the detached signature and signing time

The pack's aggregate provenance is independent only when every linked artifact has verified independent custody. Mixed, recorder, CLI, and manual evidence is customer-attested; imported-only evidence is imported.

Creation boundary

Sealing is available only to eligible private-pilot contracts. It fails closed unless the revision is approved, linked evidence bytes are retained and checksum-valid, every artifact is in the verified state, private object storage is available, the signer resolves through the configured registry, and both timestamp commitments validate.

The service limits individual evidence artifacts to 50 MiB and the complete conformance pack to 250 MiB. Repeating the same statement and template seal is idempotent.

Custody and interpretation

Pack evidence can contain product text, identifiers, screenshots, accessibility tree data, and evaluator notes. Transfer and retain it under the same controls as the source evidence. Revoking a share prevents future account-free access; it cannot delete a copy already downloaded by a recipient.

Strict verification proves included-byte integrity, configured signer origin, and timestamp trust. It does not certify accessibility, prove that a changed site still renders the same way, or guarantee legal or procurement acceptance.

Continue with the Manifest Specification or the Offline Verifier.