Technical Concepts
Artifact separation
The deliverable, the evidence and the snapshot are uploaded separately, so delivering a pack cannot leak the evidence set even by mistake.
What it is
Four separate artefacts per run: the board pack, the assessment snapshot, the raw evidence set, and a small outcome record.
Why separation matters
The delivery path can only ever resolve the pack. Evidence cannot leave through it, because it is not there to be resolved.
Had the pack and the evidence shared one archive, delivery would be one filename mistake away from handing a customer the raw evidence set, and one permissions mistake away from something worse.
Different retentions, for different reasons
| Artefact | Default | Why |
|---|---|---|
| Raw evidence | 1 day | Most sensitive, needed by nobody afterwards |
| Board pack | 7 days | Retrieved and stored by GovIntel promptly |
| Snapshot | 90 days | Carries no identifiers; it is the comparison window |
| Outcome record | 7 days | A few lines of provenance |
Named files, never a directory
The pack artefact names its files individually rather than uploading a directory, because the directory also holds internal working files. A test fails if that ever becomes a directory upload or a wildcard.