Audit Evidence

{
  "schema": "tg.attestation",
  "context_tag": "TG-ATTESTATION-V1",
  "attestation_version": "1.0",
  "attestedAt": "2026-09-14T21:51:21.865439Z",
  "nonce": "a0808468746d129bd5a449694b5c0202eb0d242f751dab039650e332f843a629",
  "installation": {
    "installationId": "tg-7c4f1e",
    "applianceUrl": "https://tg-appliance.meridian.internal:8443"
  },
  "pipeline": {
    "pipelineId": "03f8d448-4563-453b-a6ed-b6b3fc7d83f0",
    "label": "aws-gcp",
    "from": "gcp",
    "to": "aws",
    "fromRegion": "us-east-2",
    "toRegion": "us-central1",
    "sourceBucket": "tg-7c4f1e-aws-gcp-source",
    "stagingBucket": "tg-7c4f1e-aws-gcp-staging",
    "landingBucket": "tg-7c4f1e-aws-gcp-landing",
    "destBucket": "tg-7c4f1e-aws-gcp-dest"
  },
  "accountability": {
    "customer_declared": {
      "initiating_organization": "Meridian Health Network",
      "authorized_by": "A. Whitfield",
      "role": "VP, Information Security",
      "authorization_basis": "HIPAA Data Movement Policy SEC-001",
      "authorization_date": "2026-05-01"
    },
    "tg_observed": {
      "pipeline_name": "aws-gcp",
      "pipeline_id": "03f8d448-4563-453b-a6ed-b6b3fc7d83f0",
      "deployment_date": "2026-05-23T00:12:00Z",
      "cloud_context": {
        "source": {
          "provider": "aws",
          "account_id": "441903772074",
          "region": "us-east-2"
        },
        "destination": {
          "provider": "gcp",
          "account_id": "meridian-health-prod",
          "region": "us-central1"
        }
      },
      "tg_execution_identity": {
        "source": "arn:aws:iam::441903772074:role/tg-7c4f1e-worker-role",
        "destination": "tg-7c4f1e-worker@meridian-health-prod.iam.gserviceaccount.com"
      }
    }
  },
  "subject": {
    "tgId": "26e0e72027abd4501c4bf5ced83dbb85b1e6b4fc70495b662922fd839b12c391",
    "objectKeyAtSource": "patient001_study002_series05_img010.dcm",
    "objectKeyAtDest": "patient001_study002_series05_img010.dcm",
    "sourceEtag": "COGq1++cnJUDEAE=",
    "destEtag": "\"4e2ab3115963d7378ffe43d8a5cef3b0-26\"",
    "source_hash": "7756cef737283c3232dfd80639d60a5d184e1db727576ade8eeb249afc2e1fad",
    "destination_hash": "7756cef737283c3232dfd80639d60a5d184e1db727576ade8eeb249afc2e1fad",
    "hash_match": true,
    "contentHashAlgorithm": "SHA-256",
    "bytes": 268444629,
    "bytesHuman": "256.0 MB (268,444,629 bytes)",
    "transfer_started_at": "2026-09-14T21:49:55.866875Z",
    "transfer_completed_at": "2026-09-14T21:51:21.497294Z"
  },
  "cryptoPosture": {
    "encryptionAlgorithm": "AES-256-GCM",
    "fipsValidated": true,
    "fipsPostureDescription": "All crypto operations performed by the OpenSSL FIPS Provider, CMVP certificate #4985 (FIPS 140-3, Level 1)",
    "cryptoLibrary": "cryptography 46.0.7 / OpenSSL 3.1.2 1 Aug 2023 (FIPS provider enabled)",
    "pattern": "Envelope (encryption key wrapped by customer’s KMS)"
  },
  "immudbAnchor": {
    "db": "tgaudit",
    "txIdBeforeSigning": 1648,
    "txHashBeforeSigningHex": "86a13b8265ad28d2b3283494513472f956ed03f5bf82033b9574db6ca610768c",
    "txIdAfterSigning": 1648,
    "txHashAfterSigningHex": "86a13b8265ad28d2b3283494513472f956ed03f5bf82033b9574db6ca610768c",
    "serverSignatureB64": "MEUCICEDeSjnmguwtx73APgTynwSULH6yqsNbgoY\u2026",
    "serverPublicKeyB64": "BMFnD485hFsOz1BRRDxCcR/k7FR/ZcrdmQG7jupG7xuvo5ZcqEUvfm1AsutchXdjWxovRTjHkeGDbDY+94rAtYQ="
  },
  "evidence": [
    {
      "timestampUs": "2026-09-14T21:49:55.866875Z",
      "event": "ENCRYPT_START",
      "severity": "AUDIT",
      "data": {
        "dst": "aws://tg-7c4f1e-aws-gcp-staging/patient001_study002_series05_img010.dcm.aes256",
        "sourceEtag": "COGq1++cnJUDEAE=",
        "src": "aws://tg-7c4f1e-aws-gcp-source/patient001_study002_series05_img010.dcm"
      },
      "chainHash": "5ec365a104e7d26442635b7eef02c754fa4533d36b463e4f891b86fea06add5c",
      "proofB64": "CpgFCMMJEosCAk0uAAAAAgAAAACAA/jUSEVjRTum7baz\u2026 [truncated]"
    },
    {
      "timestampUs": "2026-09-14T21:50:04.655324Z",
      "event": "KMS_ENCRYPT",
      "severity": "AUDIT",
      "data": {
        "dst": "aws://tg-7c4f1e-aws-gcp-staging/patient001_study002_series05_img010.dcm.aes256",
        "kms": "{'algorithm': 'SYMMETRIC_DEFAULT', 'bulkCipher': 'AES-256-GCM', 'cryptoLibrary': 'cryptography 46.0.7 / OpenSSL 3.1.2 1 Aug 2023', 'fipsEnabled': True, 'keyId': 'projects/meridian-health-prod/locations/us-central1/keyRings/tg-7c4f1e-keyring/cryptoKeys/tg-7c4f1e-key/cryptoKeyVersions/1', 'operation': 'encrypt', 'provider': 'gcp', 'timestamp': '2026-09-14T21:49:58.417673+00:00'}",
        "src": "aws://tg-7c4f1e-aws-gcp-source/patient001_study002_series05_img010.dcm"
      },
      "chainHash": "beaa539eb2da275690f261b8fc9c442edb10bbfdbebb33f709f3b0c5fd1b5c69",
      "proofB64": "CuQHCMwJEosCAk0uAAAAAgAAAACAA/jUSEVjRTum7baz\u2026 [truncated]"
    },
    "\u2026 19 more rows (full bundle in download)"
  ],
  "checkpointAnchorPriorTxId": 1084,
  "attestedSequenceNumber": 1,
  "signature": {
    "algorithm": "EC_SIGN_P384_SHA384",
    "keyResourceName": "projects/meridian-health-prod/locations/us-central1/keyRings/tg-keyring/cryptoKeys/tg-attestation-signing-key/cryptoKeyVersions/1",
    "publicKeyFingerprintSha256": "b0d7ce9c0cf19d76da0b16fbf04d16077b26824abbe2a8c8c359d572e2f7f495",
    "payloadSha256": "95337201177964715e151a5f5f4ca5760c45cc391dc41779e4660a71abc3b4e5",
    "sig": "MGQCME07/ExxQzvsf/WmwKowb1uJv6UF4CthTrPxKaUNNxeo\u2026",
    "canonicalization": "RFC8785/JCS"
  }
}

timestamp_utc,event,severity,details
2026-09-14T21:49:55.866875Z,ENCRYPT_START,AUDIT,src=aws://tg-7c4f1e-aws-gcp-source/patient001_study002_series05_img010.dcm
2026-09-14T21:50:04.655324Z,KMS_ENCRYPT,AUDIT,src=aws://tg-7c4f1e-aws-gcp-source/patient001_study002_series05_img010.dcm
2026-09-14T21:50:04.817433Z,ENCRYPT_HASH_COMPUTED,AUDIT,hash=7756cef737283c3232dfd806…
2026-09-14T21:50:04.950169Z,ENCRYPT_METADATA_WRITTEN,AUDIT,—
2026-09-14T21:50:05.222330Z,ENCRYPT_COMPLETE,AUDIT,src=aws://tg-7c4f1e-aws-gcp-source/patient001_study002_series05_img010.dcm
2026-09-14T21:50:05.396158Z,ENCRYPT_SOURCE_DELETED,AUDIT,src=aws://tg-7c4f1e-aws-gcp-source/patient001_study002_series05_img010.dcm
2026-09-14T21:50:05.527965Z,OP_SUCCESS,AUDIT,op=encrypt | src=aws://tg-7c4f1e-aws-gcp-source/patient001_study002_series05_img010.dcm | 256.0 MB | 9678ms
2026-09-14T21:50:15.392238Z,TRANSFER_START,AUDIT,src=aws://tg-7c4f1e-aws-gcp-staging/patient001_study002_series05_img010.dcm.aes256
2026-09-14T21:50:15.534198Z,TRANSFER_METADATA_READ,AUDIT,hash=7756cef737283c3232dfd806…
2026-09-14T21:50:15.948805Z,TRANSFER_METADATA_WRITTEN,AUDIT,—
2026-09-14T21:50:24.645801Z,TRANSFER_COMPLETE,AUDIT,src=aws://tg-7c4f1e-aws-gcp-staging/patient001_study002_series05_img010.dcm.aes256 | 256.0 MB
2026-09-14T21:50:24.826243Z,TRANSFER_SOURCE_DELETED,AUDIT,src=aws://tg-7c4f1e-aws-gcp-staging/patient001_study002_series05_img010.dcm.aes256
2026-09-14T21:50:24.982665Z,OP_SUCCESS,AUDIT,op=transfer | src=aws://tg-7c4f1e-aws-gcp-staging/patient001_study002_series05_img010.dcm.aes256 | 256.0 MB | 9575ms
2026-09-14T21:51:11.891645Z,DECRYPT_START,AUDIT,src=gcp://tg-7c4f1e-aws-gcp-landing/patient001_study002_series05_img010.dcm.aes256
2026-09-14T21:51:11.930042Z,DECRYPT_METADATA_READ,AUDIT,hash=7756cef737283c3232dfd806…
2026-09-14T21:51:20.931955Z,KMS_DECRYPT,AUDIT,src=gcp://tg-7c4f1e-aws-gcp-landing/patient001_study002_series05_img010.dcm.aes256
2026-09-14T21:51:20.973229Z,DECRYPT_HASH_COMPUTED,AUDIT,hash=7756cef737283c3232dfd806…
2026-09-14T21:51:21.198530Z,DECRYPT_HASH_VERIFIED,AUDIT,hash=7756cef737283c3232dfd806…
2026-09-14T21:51:21.280805Z,DECRYPT_COMPLETE,AUDIT,src=gcp://tg-7c4f1e-aws-gcp-landing/patient001_study002_series05_img010.dcm.aes256
2026-09-14T21:51:21.457983Z,DECRYPT_SOURCE_DELETED,AUDIT,src=gcp://tg-7c4f1e-aws-gcp-landing/patient001_study002_series05_img010.dcm.aes256
2026-09-14T21:51:21.497294Z,OP_SUCCESS,AUDIT,op=decrypt | src=gcp://tg-7c4f1e-aws-gcp-landing/patient001_study002_series05_img010.dcm.aes256 | 256.0 MB | 9672ms
2026-09-14T21:51:21.865439Z,ATTESTATION_DEPOSITED,AUDIT,