CRE::Compliance::Bundle
Bundle assembles a self-verifying evidence ZIP for a compliance auditor. Layout: evidence.zip/ README.md - what's in here, how to verify manifest.json - file checksums + signature audit_log.ndjson - raw audit events with hash-chain fields audit_batches.json - signed Merkle batch roots over the period public_key.pem - Ed25519 public key (32 hex bytes; SHA-256 covered by manifest so substitution shows up as a manifest checksum mismatch) control_mapping.json - event_type -> framework controls