Audit Evidence

{
  "schema": "tg.attestation",
  "context_tag": "TG-ATTESTATION-V1",
  "attestation_version": "1.0",
  "attestedAt": "2026-06-23T01:48:19.782902Z",
  "nonce": "a0808468746d129bd5a449694b5c0202eb0d242f751dab039650e332f843a629",
  "installation": {
    "installationId": "tg-7c4f1e",
    "applianceUrl": "https://tg-appliance.meridian.internal:8443"
  },
  "pipeline": {
    "pipelineId": "03f8d448-4563-453b-a6ed-b6b3fc7d83f0",
    "label": "gcp1-aws1",
    "from": "gcp",
    "to": "aws",
    "fromRegion": "us-east5",
    "toRegion": "us-east-2",
    "sourceBucket": "tg-7c4f1e-gcp1-aws1-source",
    "stagingBucket": "tg-7c4f1e-gcp1-aws1-staging",
    "landingBucket": "tg-7c4f1e-gcp1-aws1-landing",
    "destBucket": "tg-7c4f1e-gcp1-aws1-dest"
  },
  "accountability": {
    "customer_declared": {
      "initiating_organization": "Meridian Health Network",
      "authorized_by": "A. Whitfield",
      "role": "VP, Information Security",
      "authorization_basis": "HIPAA Data Movement Policy SEC-001",
      "authorization_date": "2026-05-01"
    },
    "tg_observed": {
      "pipeline_name": "gcp1-aws1",
      "pipeline_id": "03f8d448-4563-453b-a6ed-b6b3fc7d83f0",
      "deployment_date": "2026-05-23T00:12:00Z",
      "cloud_context": {
        "source": {
          "provider": "gcp",
          "account_id": "meridian-ai-prod",
          "region": "us-east5"
        },
        "destination": {
          "provider": "aws",
          "account_id": "441903772074",
          "region": "us-east-2"
        }
      },
      "tg_execution_identity": {
        "source": "[email protected]",
        "destination": "arn:aws:iam::441903772074:role/tg-7c4f1e-worker-role"
      }
    }
  },
  "subject": {
    "tgId": "26e0e72027abd4501c4bf5ced83dbb85b1e6b4fc70495b662922fd839b12c391",
    "objectKeyAtSource": "patient001_study002_series05_img010.dcm",
    "objectKeyAtDest": "patient001_study002_series05_img010.dcm",
    "sourceEtag": "COGq1++cnJUDEAE=",
    "destEtag": "\"4e2ab3115963d7378ffe43d8a5cef3b0-26\"",
    "source_hash": "7756cef737283c3232dfd80639d60a5d184e1db727576ade8eeb249afc2e1fad",
    "destination_hash": "7756cef737283c3232dfd80639d60a5d184e1db727576ade8eeb249afc2e1fad",
    "hash_match": true,
    "contentHashAlgorithm": "SHA-256",
    "bytes": 268444629,
    "bytesHuman": "256.0 MB (268,444,629 bytes)",
    "transfer_started_at": "2026-06-23T01:39:37.720287Z",
    "transfer_completed_at": "2026-06-23T01:48:19.658005Z"
  },
  "cryptoPosture": {
    "encryptionAlgorithm": "AES-256-GCM",
    "fipsValidated": true,
    "fipsPostureDescription": "All crypto operations performed by FIPS 140-2 validated modules",
    "cryptoLibrary": "cryptography 46.0.5 / OpenSSL 3.5.5 27 Jan 2026 (FIPS provider enabled)",
    "pattern": "Envelope (DEK wrapped by customer KMS)"
  },
  "immudbAnchor": {
    "db": "tgaudit",
    "txIdBeforeSigning": 1648,
    "txHashBeforeSigningHex": "86a13b8265ad28d2b3283494513472f956ed03f5bf82033b9574db6ca610768c",
    "txIdAfterSigning": 1648,
    "txHashAfterSigningHex": "86a13b8265ad28d2b3283494513472f956ed03f5bf82033b9574db6ca610768c",
    "serverSignatureB64": "MEUCICEDeSjnmguwtx73APgTynwSULH6yqsNbgoY\u2026",
    "serverPublicKeyB64": "BMFnD485hFsOz1BRRDxCcR/k7FR/ZcrdmQG7jupG7xuvo5ZcqEUvfm1AsutchXdjWxovRTjHkeGDbDY+94rAtYQ="
  },
  "evidence": [
    {
      "timestampUs": "2026-06-23T01:39:37.720287Z",
      "event": "ENCRYPT_START",
      "severity": "AUDIT",
      "data": {
        "dst": "gcp://tg-7c4f1e-gcp1-aws1-staging/patient001_study002_series05_img010.dcm.aes256",
        "sourceEtag": "COGq1++cnJUDEAE=",
        "src": "gcp://tg-7c4f1e-gcp1-aws1-source/patient001_study002_series05_img010.dcm"
      },
      "chainHash": "5ec365a104e7d26442635b7eef02c754fa4533d36b463e4f891b86fea06add5c",
      "proofB64": "CpgFCMMJEosCAk0uAAAAAgAAAACAA/jUSEVjRTum7baz\u2026 [truncated]"
    },
    {
      "timestampUs": "2026-06-23T01:39:51.151018Z",
      "event": "KMS_ENCRYPT",
      "severity": "AUDIT",
      "data": {
        "dst": "gcp://tg-7c4f1e-gcp1-aws1-staging/patient001_study002_series05_img010.dcm.aes256",
        "kms": "{'algorithm': 'SYMMETRIC_DEFAULT', 'bulkCipher': 'AES-256-GCM', 'cryptoLibrary': 'cryptography 46.0.5 / OpenSSL 3.5.5 27 Jan 2026', 'fipsEnabled': True, 'keyId': 'projects/meridian-ai-prod/locations/us-east5/keyRings/tg-7c4f1e-keyring/cryptoKeys/tg-7c4f1e-key/cryptoKeyVersions/1', 'operation': 'encrypt', 'provider': 'gcp', 'timestamp': '2026-06-23T01:39:38.452922+00:00'}",
        "src": "gcp://tg-7c4f1e-gcp1-aws1-source/patient001_study002_series05_img010.dcm"
      },
      "chainHash": "beaa539eb2da275690f261b8fc9c442edb10bbfdbebb33f709f3b0c5fd1b5c69",
      "proofB64": "CuQHCMwJEosCAk0uAAAAAgAAAACAA/jUSEVjRTum7baz\u2026 [truncated]"
    },
    "\u2026 19 more rows (full bundle in download)"
  ],
  "checkpointAnchorPriorTxId": 1084,
  "attestedSequenceNumber": 1,
  "signature": {
    "algorithm": "EC_SIGN_P384_SHA384",
    "keyResourceName": "projects/sg-attestation-prod/locations/us-east5/keyRings/ask-prod/cryptoKeys/ask-attestation-signer/cryptoKeyVersions/1",
    "publicKeyFingerprintSha256": "b0d7ce9c0cf19d76da0b16fbf04d16077b26824abbe2a8c8c359d572e2f7f495",
    "payloadSha256": "95337201177964715e151a5f5f4ca5760c45cc391dc41779e4660a71abc3b4e5",
    "sig": "MGQCME07/ExxQzvsf/WmwKowb1uJv6UF4CthTrPxKaUNNxeo\u2026",
    "canonicalization": "RFC8785/JCS"
  }
}

timestamp_utc,event,severity,details
2026-06-23T01:39:37.720287Z,ENCRYPT_START,AUDIT,src=gcp://tg-7c4f1e-gcp1-aws1-source/patient001_study002_series05_img010.dcm
2026-06-23T01:39:51.151018Z,KMS_ENCRYPT,AUDIT,src=gcp://tg-7c4f1e-gcp1-aws1-source/patient001_study002_series05_img010.dcm
2026-06-23T01:39:51.181831Z,ENCRYPT_HASH_COMPUTED,AUDIT,hash=7756cef737283c3232dfd806…
2026-06-23T01:39:51.267953Z,ENCRYPT_METADATA_WRITTEN,AUDIT,—
2026-06-23T01:39:51.480417Z,ENCRYPT_COMPLETE,AUDIT,src=gcp://tg-7c4f1e-gcp1-aws1-source/patient001_study002_series05_img010.dcm
2026-06-23T01:39:51.572641Z,ENCRYPT_SOURCE_DELETED,AUDIT,src=gcp://tg-7c4f1e-gcp1-aws1-source/patient001_study002_series05_img010.dcm
2026-06-23T01:39:51.605539Z,OP_SUCCESS,AUDIT,op=encrypt | src=gcp://tg-7c4f1e-gcp1-aws1-source/patient001_study002_series05_img010.dcm | 256.0 MB | 13938ms
2026-06-23T01:47:01.935224Z,TRANSFER_START,AUDIT,src=gcp://tg-7c4f1e-gcp1-aws1-staging/patient001_study002_series05_img010.dcm.aes256
2026-06-23T01:47:01.985879Z,TRANSFER_METADATA_READ,AUDIT,hash=7756cef737283c3232dfd806…
2026-06-23T01:47:02.138861Z,TRANSFER_METADATA_WRITTEN,AUDIT,—
2026-06-23T01:47:33.225155Z,TRANSFER_COMPLETE,AUDIT,src=gcp://tg-7c4f1e-gcp1-aws1-staging/patient001_study002_series05_img010.dcm.aes256 | 256.0 MB
2026-06-23T01:47:33.345601Z,TRANSFER_SOURCE_DELETED,AUDIT,src=gcp://tg-7c4f1e-gcp1-aws1-staging/patient001_study002_series05_img010.dcm.aes256
2026-06-23T01:47:33.374841Z,OP_SUCCESS,AUDIT,op=transfer | src=gcp://tg-7c4f1e-gcp1-aws1-staging/patient001_study002_series05_img010.dcm.aes256 | 256.0 MB | 31570ms
2026-06-23T01:47:39.203206Z,DECRYPT_START,AUDIT,src=aws://tg-7c4f1e-gcp1-aws1-landing/patient001_study002_series05_img010.dcm.aes256
2026-06-23T01:47:39.322933Z,DECRYPT_METADATA_READ,AUDIT,hash=7756cef737283c3232dfd806…
2026-06-23T01:48:18.785892Z,KMS_DECRYPT,AUDIT,src=aws://tg-7c4f1e-gcp1-aws1-landing/patient001_study002_series05_img010.dcm.aes256
2026-06-23T01:48:18.912532Z,DECRYPT_HASH_COMPUTED,AUDIT,hash=7756cef737283c3232dfd806…
2026-06-23T01:48:19.228669Z,DECRYPT_HASH_VERIFIED,AUDIT,hash=7756cef737283c3232dfd806…
2026-06-23T01:48:19.363270Z,DECRYPT_COMPLETE,AUDIT,src=aws://tg-7c4f1e-gcp1-aws1-landing/patient001_study002_series05_img010.dcm.aes256
2026-06-23T01:48:19.539188Z,DECRYPT_SOURCE_DELETED,AUDIT,src=aws://tg-7c4f1e-gcp1-aws1-landing/patient001_study002_series05_img010.dcm.aes256
2026-06-23T01:48:19.658005Z,OP_SUCCESS,AUDIT,op=decrypt | src=aws://tg-7c4f1e-gcp1-aws1-landing/patient001_study002_series05_img010.dcm.aes256 | 256.0 MB | 40484ms
2026-06-23T01:48:19.782902Z,ATTESTATION_DEPOSITED,AUDIT,