Cat-31 · Data Room Diligence

Evidence Handover Bundle

Paste a case-file binder manifest (from the Case-File Binder Composer) and, optionally, the receipts it references, and get back one zip an examiner can open on a machine with no network connection at all: a self-contained verify.html, the raw JSON receipts, and a plain-English README. Built entirely in your browser with a small vendored zip writer, no CDN, no server call.

⚠ This is a digest-level handover, not a data room. The bundle carries exactly what you paste in: the binder plus whichever receipts you attach. A binder entry with no attached receipt still ships in binder.json with its verify_hint intact, so the examiner knows where to go get it.
Offline Verify Zero Network Zero PII Client-Side
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Binder
DNSSEC Chain Capture (optional corroboration)
Corroboration, not proof (the one statement of that line is in the Bundle Format Reference below). Paste a DNSSEC chain you captured externally with dig +dnssec against a validating resolver at build time. This tool stores the raw record text as-is and does not query DNS or validate the chain itself; validation is deferred to standard tooling (delv, or any validating stub resolver).
not attached, bundle will ship without a DNSSEC chain capture
Bundle Format Reference
Every bundle this tool builds is one zip with the same layout: verify.html (a self-contained offline verifier), binder.json (the signed case-file binder manifest), receipts/ (whichever receipts were attached at build time), an optional dnssec-chain-capture.json, and README.txt (the same reference in plain English, inside the zip).
The optional DNSSEC capture object has four fields: queried_name, the domain or record the capture covers; resolver, the validating resolver that answered; captured_at, the ISO 8601 time of the capture; and raw_chain_text, the unmodified dig +dnssec output from the leaf RRSIG and DNSKEY through the DS records up to the root. The tool stores the object verbatim. It never queries DNS itself and never validates the chain; confirming the chain is deferred to standard tooling, such as delv or any validating stub resolver, replayed against the well-known, publicly pinned root KSK.
Proof vs corroboration, for this whole bundle: proof is its own hashes and timestamp anchors, self-contained and re-verifiable offline, and it is the part a reviewer relies on. Corroboration is a third-party public record that happened to capture the same fact around the same time, independently of this tool; it supports a narrative and is never load-bearing. A bundle with zero corroboration items is fully valid and unweakened. The DNSSEC chain capture is corroboration, and every surface that renders it says so and points here; this paragraph is the one statement of the line, and README.txt carries the same statement inside every bundle.