Kill receipt is VALID only after cut then adversarial replay of the old grant fails. Vendor revoked=true is not ground truth. Never put secrets in git.

IR Evidence Pack

Customer-held evidence for IR tickets and evidence lockers — not a compliance certification. Not a SOC 2 claim.

Design-partner motion: /start success = VALID bounce + optional WITHHELD false-green → download Evidence Pack ZIP. Console and home CTA: IR Residual Trust Pack (/packs/ir). Receipt page: Evidence Pack ZIP.

Download

All receipts ZIP: /api/compliance/export?format=zip&pack=evidence
Optional incident id: &incidentId=INC-1234 (stamped into VERIFY.txt and filename)
Optional campaign: filter via receipt campaignId then export
Single receipt: /api/compliance/export?format=zip&pack=evidence&receiptId={id}
Receipt page button: “Evidence Pack ZIP”

ZIP contents

File	Purpose
`receipts.json` or `receipt.json`	Proof Engine v2 export document(s)
`VERIFY.txt`	VALID vs WITHHELD, MTPR, HMAC verify API pointer
`README.txt`	Evidence-locker framing

Kill receipt bar

VALID — failed-replay / absence probe bounced.
WITHHELD — old credential still worked (false green). Do not tell the board it is gone.
probeError — transport failed; no stamp (re-run).
Vendor revoked=true is never sole evidence.

MTPR

MTPR = Mean Time to Proven Revocation (cut request → VALID bounce or WITHHELD). Persisted on the receipt (mtprMs, cutRequestedAt, provedAt) and summarized on /receipts.

Retention / export / delete (ops runbook)

Short defensive ops — adjust to your IR retention policy.

Action	How
Export	Download Evidence Pack ZIP (`/api/compliance/export?format=zip&pack=evidence`). In production hardening, `RECEIPT_SIGNING_SECRET` is required — VERIFY.txt points at HMAC verify.
Verify	`GET` or `POST /api/receipts/{id}/verify` with the same `RECEIPT_SIGNING_SECRET` as the cut plane. Signature proves receipt bytes integrity, not vendor honesty.
Retention	Keep customer-held ZIPs in the IR evidence locker per ticket SLA (e.g. 90 days / matter close). App storage: Upstash list or `.data/receipts.jsonl` (Compose volume) — treat as operator working set, not the sole archive.
Delete (operator)	Remove or rotate the Upstash key / wipe `.data/receipts.jsonl` and `.data/pending-cuts.json` only after export to the locker and ticket close. Redeploy does not erase Upstash. Rotate `RECEIPT_SIGNING_SECRET` only with a deliberate re-sign or accept that old signatures verify only with the old secret (keep old secret offline for historical verify).
Session cookies	OAuth AEAD cookies (~2h TTL). Operator logout clears `lc_operator`. Clearing provider cookies forces re-login (legacy plaintext cookies are auto-cleared).

Production pilots: do not rely on unsigned JSON. Fail-closed hardening refuses APIs without RECEIPT_SIGNING_SECRET — see [HARDENING.md](./HARDENING.md).

See also: [AUDITOR_INSURANCE.md](./AUDITOR_INSURANCE.md), [RECEIPT_INTEGRITY.md](./RECEIPT_INTEGRITY.md), [BEACHHEAD.md](./BEACHHEAD.md).