{
  "manifest_id": "mfst_evidencepkg_v1_2026-05-18",
  "schema_version": "1.0.0",
  "synthetic": true,
  "synthetic_notice": "All artifacts in this manifest reference SYNTHETIC sample data. Hashes are real (computed over the actual file bytes); signer key (vke_synthetic_2026-05) is synthetic and intentionally exposed for reproducibility.",
  "audit_period": {
    "from": "2026-05-18T00:00:00Z",
    "to": "2026-05-18T23:59:59Z"
  },
  "sample_criteria": "synthetic; single workflow; demonstration only",
  "artifacts": [
    {
      "path": "receipt.json",
      "sha256": "015b007b153712557e82d19b1ac26cd8cec6a47fc7c8b0abe0da3bedf9bc14aa",
      "bytes": 2290,
      "description": "Synthetic healthcare workflow receipt"
    },
    {
      "path": "framework_mapping.md",
      "sha256": "0f945c2d9dc252b49831c5d6049afa34c89eeabcd42debae8b9849fecab6f424",
      "bytes": 4276,
      "description": "Illustrative receipt-field crosswalk to NIST AI RMF and EU AI Act topics; no control-satisfaction claim"
    },
    {
      "path": "README.md",
      "sha256": "91130e14fb14d645c209f772ba81c171e78e5cf49ff8a7bb8c8b88cc48e26a7c",
      "bytes": 20570,
      "description": "Package overview and verification instructions"
    },
    {
      "path": "verifier_cli.py",
      "sha256": "2fb97622f4c54aada4d7865fa0fe6c9c7c2956a0253dc1ed9303d9069e7687ca",
      "bytes": 144189,
      "description": "Standalone Python verifier; depends only on the `cryptography` and `rfc8785` packages"
    },
    {
      "path": "sign_and_verify.py",
      "sha256": "2d92ca897e7926a71bb8b929330eda16f438832226987e2466b684a500f38842",
      "bytes": 22548,
      "description": "Build script: derives the synthetic keypairs, signs the receipt, session export and manifest, runs the verifier in every mode"
    },
    {
      "path": "public_key.json",
      "sha256": "95e29f4b959fe6f7b4a37c6f7a9bbc5045baca07744d37dc21c249e47c44c024",
      "bytes": 445,
      "description": "Synthetic Ed25519 public key (vke_synthetic_2026-05) for offline verification"
    },
    {
      "path": "session_export.json",
      "sha256": "f662eb68b96def3bfa7b349e0753f775d2f80b8ef26ed2a37d5b66c8b740c1f3",
      "bytes": 6458,
      "description": "Synthetic session export: a three-event hash-linked chain signed under rfc8785-jcs-v1, plus the legacy-canonicalized receipt"
    },
    {
      "path": "public_keyring.json",
      "sha256": "a0c50bd35b9233656b7c9a65aa57be0da6651a830fca56139276b8f9c7a615d4",
      "bytes": 599,
      "description": "Public-only keyring with one active and one retired synthetic key, for verification across key rotation"
    },
    {
      "path": "LICENSE",
      "sha256": "8135def8677f2c9d3ec8c9b4255094a934c488b5c9600412f08e697fd5792400",
      "bytes": 1073,
      "description": "MIT License for the verifier tool"
    },
    {
      "path": "verifier_transcript.txt",
      "sha256": "e8924957c94c1cce4229fbd33a2bc6fd680558e72ec30409397cd12603cab658",
      "bytes": 27236,
      "description": "Recorded verifier run, every documented mode; deterministic, so the manifest can commit to it"
    }
  ],
  "signer_key_id": "vke_synthetic_2026-05",
  "signer_public_key_hex": "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
  "manifest_signature": "ed25519:af6b8f2c2588932eae7f277bcfb1309bf82cce0b4bbbe1ec5b82c20ea59bc6e9b8e93492139f5ba53496618fea37731ef641c587284b21dd78fd398400d7c20c"
}