The Custody page

The Custody page answers “who holds this workspace’s evidence, and is it sealed?” It is the page an auditor should be shown first.

Three holders

Storage. Who holds it (Stratl-managed or your bucket), the backend, the location, that every version is kept and that the service has no delete permission, and the folder layout so the bucket can be audited without Stratl.

Signing key. The algorithm (ES256), the custodian, the key id, whether the private key is exportable (it never is in a key service; on a developer machine it is a file), how many times the key has been used and how many uses await sealing, and how many key-usage records have been sealed into the stream with a link to the latest. The public key is shown in JWK form for anyone who wants to copy it.

Independent time. The timestamp authorities, how many checkpoints are timestamped, the cadence (hourly, or every thousand records), and whether OpenTimestamps is on (not yet).

The chain strip

The chain head (the number of records in the workspace stream), the hash of the last record, how many records await a checkpoint, and how many checkpoints have sealed the stream. Checkpoint now seals everything pending immediately; engineers, admins and owners may press it.

Retention and legal holds

The workspace policy in words, with who set it and when, the counts of records retained, past retention and on hold, and every active hold with its reason and who placed it. Edit policy is for owners and admins. Retention and holds.

Checkpoints

Newest first: sequence, Merkle root, leaves, the chain range it covers, when it was created, and the RFC 3161 status with the time the authority attested. A checkpoint whose timestamp failed is marked and retried automatically.

Take custody

The owner sees Take custody. It opens a dialog that walks through choosing a cloud, running the set-up script in your account, pasting what it printed, Prove it (the four-step probe), and then moving. After the move, a banner reports which cloud holds custody, who took it and when, the progress of copying history, and a link to the transfer record. The whole procedure, and what happens to old records.

The Local dev banner

On a developer machine, a banner says records are signed with a development key on that machine and stored on its disk. Timestamps are still real. Nothing shown on this page in that mode should be presented to anyone as production custody.