Skip to content

LLND Evidence Vault — Sealing Discipline

Store: rtopacks-llnd-evidence-prod / rtopacks-llnd-evidence-dev (R2). Class: sealed custody (no D1 schema). Created: LLND-BUILD-01 (2026-07-10), outside Terraform (wrangler); IaC debt owed to TERRAFORM-V5-RECONCILIATION-01.

Holds: the LLND tile's conducted-assessment evidence — at launch, response sets and interaction records (the authenticity anchors of a conducted digital result — LLND-CONDUCT-01, ADR-065), and the external documents backing external-grade results. The D1 side (rtopacks-llnd, dev f42fb4ad-4a4b-45b3-9ec0-fc955bc488eb / prod b1c051bd-0f68-49fe-9eb5-f767a69aba86) carries the metadata — llnd_result.response_set_ref, the interaction-record ref, external_document_ref — and each result seals the digest; the bytes live here.

Key convention (launch). Conducted digital artefacts: {review_id}/digital/{response_set|interaction_record}/{digest}. External documents (workspace-written): {review_id}/{capability_class}/external_document/{digest}.

Dual-writer vault. internal-api is the writer for the conducted artefacts (response sets, interaction records); workspace writes the external documents. The vault is written by both surfaces, each on its own key prefix.

AV recordings are day-two and biometric-adjacent (LLND-CONDUCT-01, ADR-065): no browser media permission is requested at launch. When AV arrives (with the oral-communication AV task), it is a separate artefact class carrying its own consent and retention posture — the biometric-adjacent language below scopes to AV recordings, not to the interaction record.

The sealing contract

  • Digest-sealed at landing. Every object's sha256 is recorded on the referencing llnd_result row. Object-key convention: the launch keys above ({review_id}/digital/{response_set|interaction_record}/{digest} for conducted digital artefacts; {review_id}/{capability_class}/external_document/{digest} for external documents).
  • Immutable — amendments are new objects, never overwrites. R2 has no native write-once; immutability is enforced by the consuming surface's write path (put-if-absent by key; an overwrite is a defect). Documented here, enforced with the surface (out of scope for the store-creation brief).
  • Replay guarantee. A conducted advice challenged at audit replays from bytes — the sealed response set and interaction record — not from a score (llnd-02 §4.1, §4.4). The vault is the byte half of that guarantee; the D1 result is the metadata half.
  • AV recordings are biometric-adjacent (day-two; the tightest gate — LLND-CONDUCT-01, ADR-065). When AV lands, consent is captured at intake per anchor and recordings carry their own retention posture, distinct from the document floor (llnd-00, held). Retention values are configured defaults set with the consuming tile — not constants minted at store creation. This language scopes to AV, not to the launch interaction record.
  • Access posture is T4-only at launch. Sensitive capability evidence gates to the client's T4, scoped by client_ref (llnd-02 §9.3, ratified 2026-07-10 — the assigned-T4A refinement waits on the assignment edge). The classification is recorded here; the enforcement binds with the surface, not at store creation.

Scope note

LLND-BUILD-01 created the bucket pair only — it lands no objects, mounts no worker binding, and mounts no surface. Capture logic (consent-gated capture, digest-sealing at write, immutability enforcement, retention values, T4-only access enforcement) rides the LLND surface brick (a later brief), which exercises it against a live consumer. Distinct from rtopacks-candidate-capture-* (the shared intake capture vault, SHARED-SPINE-STORES-01 — ID images / attestation at the intake seam) and from the future rtopacks-rpl-evidence-* (the RPL tile's own evidence vault). The LLND vault holds the tile's own conducted-assessment bytes; the intake vault holds the pipeline's capture bytes.