{
  "_comment": "Sample subset of audit-export `events.json` — what you'd find inside audit-export-<tenant>-<from>-<to>.zip. Each event is canonical; the chain is tamper-evident: any modification breaks the chain_hmac on every subsequent event. Full export available at /audit/export.",
  "tenant_id": "01HX7SAMPLE0000000000000",
  "exported_at": "2026-04-25T12:34:56.789Z",
  "range": { "from_index": 138, "to_index": 145 },
  "events": [
    {
      "chain_index": 138,
      "event_type": "scan_completed",
      "actor_device_id": "dev_sample_ops_01",
      "actor_nickname": "ops-bot",
      "subject_kind": "scan",
      "subject_label": "sandbox-shop nightly scan",
      "issued_at": "2026-04-25T03:00:11.220Z",
      "prev_receipt_id": "rcpt_137_sample",
      "event_hash": "sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b",
      "chain_hmac": "f1e2d3c4b5a69788776655443322110099aabbccddeeff00112233445566778899"
    },
    {
      "chain_index": 139,
      "event_type": "ack_finding",
      "actor_device_id": "dev_sample_a1b2c3d4e5f6",
      "actor_nickname": "demo-signer",
      "subject_kind": "finding",
      "subject_label": "f1: rls_off on customer_profiles",
      "issued_at": "2026-04-25T07:18:43.001Z",
      "prev_receipt_id": "rcpt_138_sample",
      "event_hash": "sha256:2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c",
      "chain_hmac": "e2d3c4b5a69788776655443322110099aabbccddeeff00112233445566778899aa",
      "payload": { "ack_kind": "scheduled_fix", "fix_eta": "2026-04-29" }
    },
    {
      "chain_index": 140,
      "event_type": "encrypt",
      "actor_device_id": "dev_sample_a1b2c3d4e5f6",
      "actor_nickname": "demo-signer",
      "subject_kind": "field",
      "subject_label": "customer_profiles.phone",
      "subject_hash": "sha256:086fb29f1d7eaf2c4b9c3a8e5d1f6072c4a89b3e2f7d09e1a4b6c8d3f5a7b9c1",
      "issued_at": "2026-04-25T09:42:15.110Z",
      "prev_receipt_id": "rcpt_139_sample",
      "event_hash": "sha256:3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d",
      "chain_hmac": "d3c4b5a69788776655443322110099aabbccddeeff00112233445566778899aabb",
      "payload": { "rows_affected": 12840, "kek_id": "kek_sandbox_v3" }
    },
    {
      "chain_index": 141,
      "event_type": "license_issue",
      "actor_device_id": "dev_sample_a1b2c3d4e5f6",
      "actor_nickname": "demo-signer",
      "subject_kind": "license",
      "subject_label": "license_business_2026q2",
      "issued_at": "2026-04-25T11:30:00.000Z",
      "prev_receipt_id": "rcpt_140_sample",
      "event_hash": "sha256:4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e",
      "chain_hmac": "c4b5a69788776655443322110099aabbccddeeff00112233445566778899aabbcc",
      "payload": { "tier": "business", "device_count": 3, "valid_until": "2026-07-25" }
    },
    {
      "chain_index": 142,
      "event_type": "sign",
      "actor_device_id": "dev_sample_a1b2c3d4e5f6",
      "actor_nickname": "demo-signer",
      "subject_kind": "file",
      "subject_label": "secret-roadmap.pdf",
      "subject_hash": "sha256:086fb29f1d7eaf2c4b9c3a8e5d1f6072c4a89b3e2f7d09e1a4b6c8d3f5a7b9c1",
      "issued_at": "2026-04-25T12:34:56.789Z",
      "prev_receipt_id": "rcpt_141_sample",
      "event_hash": "sha256:9b2e7a1f6d4c3b8e5a09f2d7c1b4e6a8f3d9c5b7e2a4f6d8c1b3e5a7f9d2c4b6",
      "chain_hmac": "a3f7e92b1c8d4e6f5a09b2c7d1e3f6a8b4c5d7e9f1a2b3c4d5e6f7a8b9c0d1e2"
    },
    {
      "chain_index": 143,
      "event_type": "verify",
      "actor_device_id": "dev_sample_external_auditor",
      "actor_nickname": "external-auditor",
      "subject_kind": "receipt",
      "subject_label": "rcpt_142_sample_8a3f2c1b",
      "issued_at": "2026-04-25T13:01:22.500Z",
      "prev_receipt_id": "rcpt_142_sample",
      "event_hash": "sha256:5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f",
      "chain_hmac": "b5a69788776655443322110099aabbccddeeff00112233445566778899aabbccdd",
      "payload": { "result": "valid", "verified_via": "/api/verify" }
    },
    {
      "chain_index": 144,
      "event_type": "sign_tree",
      "actor_device_id": "dev_sample_a1b2c3d4e5f6",
      "actor_nickname": "demo-signer",
      "subject_kind": "directory",
      "subject_label": "release-2026-q2",
      "subject_hash": "sha256:7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "issued_at": "2026-04-25T14:15:08.220Z",
      "prev_receipt_id": "rcpt_143_sample",
      "event_hash": "sha256:6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a",
      "chain_hmac": "a69788776655443322110099aabbccddeeff00112233445566778899aabbccddee",
      "payload": { "files": 248, "merkle_depth": 8 }
    },
    {
      "chain_index": 145,
      "event_type": "audit_export",
      "actor_device_id": "dev_sample_a1b2c3d4e5f6",
      "actor_nickname": "demo-signer",
      "subject_kind": "export",
      "subject_label": "audit-export-138-145",
      "issued_at": "2026-04-25T15:00:00.000Z",
      "prev_receipt_id": "rcpt_144_sample",
      "event_hash": "sha256:7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "chain_hmac": "9788776655443322110099aabbccddeeff00112233445566778899aabbccddeeff"
    }
  ]
}