TLPT Evidence Pack v1 Contract

Contract ID: CONTRACT-TLPT-EVIDENCE-PACK-V1-031 Version: tlpt-evidence-pack.v1 Status: Draft Owner: EvidenceLocker Guild Last updated: 2026-05-01

Purpose

TLPT Evidence Pack v1 is the signed EvidenceLocker capsule manifest for DORA threat-led penetration testing evidence. The pack is white-team/evidence-side only: it binds the approved TLPT scope, the frozen Replay baseline, the controls inventory, runtime instrumentation snapshots, post-test attestations, and white-team sign-off. It does not run offensive tooling.

This contract is for engineers and white-team auditors assembling or verifying the final DORA TLPT evidence capsule. The pack is the terminal artifact of the TLPT evidence chain: scope → baseline → evidence pack.

Export Center Assurance Profile

ExportCenter advertises the dora.tlpt-evidence-pack assurance profile for discovery and readiness. Signed export readiness remains fail-closed on dora-tlpt-evidence-pack-scope-missing, dora-tlpt-evidence-pack-white-team-signoff-missing, and dora-tlpt-evidence-pack-schema-mapping-missing until the TLPT scope, baseline/evidence refs, and white-team sign-off are supplied by the owning EvidenceLocker/TLPT workflow.

POST /v1/exports/assurance/profiles/dora.tlpt-evidence-pack/runs is registered on the shared Assurance produce surface. The request body supplies tlptEvidencePack, using the same CreateTlptEvidencePackRequest shape as EvidenceLocker. While readiness is blocked and no request-scoped TLPT pack is supplied, ExportCenter returns HTTP 409 assurance_export_readiness_blocked. When the request supplies the TLPT scope, baseline, controls inventory, runtime instrumentation, post-test attestations, and sign-off, ExportCenter delegates assembly/signing to EvidenceLocker POST /api/v1/evidence/capsules/tlpt-packs and persists the returned sealed TlptEvidencePackResponse JSON as the Assurance run artifact. ExportCenter does not assemble or sign TLPT packs locally.

Schema Pinning

Request Shape

The assembly request (CreateTlptEvidencePackRequest) carries only the caller-supplied inputs. The server derives identifiers, timestamps, generator, retention, and expectedSignerKeyId. Required request fields:

The request does not accept capsuleId, packId, tenantId, createdAt, generator, retention, or expectedSignerKeyId; those are computed during assembly.

Manifest Shape

TlptEvidencePackManifest top-level fields:

Response Shape

The endpoint returns TlptEvidencePackResponse (HTTP 201 Created, Location: /api/v1/evidence/capsules/{capsuleId}) with:

Artifact references use this shape:

{
  "artifactType": "runtime-signals",
  "artifactRef": "capsule-input://tlpt/runtime/pre-signals.json",
  "artifactHash": "sha256:5555555555555555555555555555555555555555555555555555555555555555",
  "capturedAt": "2026-05-01T09:00:00Z",
  "description": "optional short description"
}

Determinism Rules

Signing And Verification

TLPT pack assembly is a single-step seal boundary: unlike Decision Capsules (which are created unsealed, then sealed by a separate POST .../seal call), AssembleTlptEvidencePackAsync canonicalizes, signs, and persists the manifest in one operation. There is no separate seal endpoint for TLPT packs.

The pack is signed through ICapsuleSigner.SignPayloadAsync using the TLPT DSSE payload type. Protected assembly fails closed (InvalidOperationException, surfaced as HTTP 500) when no durable signer is configured unless the host enables AllowUnsignedCapsules for a local test harness, in which case the pack is persisted with signingStatus = unsigned.

After signing, the sealed capsule is projected into the verdict ledger via TryProjectSealedCapsuleAsync, so the sealing -> verdict_ledger count forcing function holds for TLPT packs identically to Decision Capsules.

Verification recomputes the canonical manifest hash and verifies the DSSE envelope against the payload type selected by manifest kind. Existing Decision Capsule verification remains on application/vnd.stellaops.decision-capsule+json.

The assembly endpoint POST /api/v1/evidence/capsules/tlpt-packs requires the evidence:create scope (StellaOpsResourceServerPolicies.EvidenceCreate) and runs under the /api/v1/evidence/capsules tenant-scoped group; data-residency write-region enforcement applies before assembly.

Retention

Default retention is 10 years. The manifest retention block records policyId dora-tlpt-evidence-default, retentionYears 10, retainUntil (createdAt plus 10 years), and a human-readable reason. The default intentionally exceeds the 3-year TLPT cycle and leaves audit lookback room across multiple cycles. These values are fixed constants in CapsuleService.AssembleTlptEvidencePackAsync — the request cannot override them. Tenant- or regulator-specific overrides are not part of this capsule slice; if added later, they must remain explicit in the manifest and audit trail.

Offline And Replay Expectations

Audit Trail Status

The capsule manifest and repository record contain the pack content hash, expected signer key id, signing status, sealed timestamp, and retention window. The service API records the same values in the audit trail through POST /api/v1/evidence/capsules/tlpt-packs. The emitted audit event has module evidence (AuditModules.Evidence) and action assemble_tlpt_pack (AuditActions.Evidence.AssembleTlptPack), with resource type tlpt_evidence_pack.

Required audit details:

The audit event id and timestamp are non-deterministic by design (opaque observability fields); they are not derived from canonical content.

Audit emission is additive to the existing local CLI pack behavior; local CLI pack creation continues to use the capsule service directly and remains offline-friendly.