Synthetic PCI DSS 11.6.1 evidence ledger sample

Chain integrityVerified
Evaluation intervalMet
CoverageComplete
Detected changes1

Evidence identity

Requirement: PCI DSS v4.0.1 requirement 11.6.1
Synthetic target: https://shop.example/checkout
Period: 2026-08-01T12:00:00+00:00 to 2026-08-04T12:00:00+00:00
Evaluations: 2
Monitor status: active
Next evaluation: 2026-08-07T12:00:00+00:00

Conclusion

The record of 2 evaluation(s) is intact, verifiable, and was maintained within the seven-day evaluation interval throughout.

Detected changes

ALERT — evaluation 2

Observed 2026-08-04T12:00:00+00:00 · detail cryptographically committed: yes

Event: "Synthetic external script added"
Scripts Added: ["https://cdn.vendor.example/pay-v2.js"]
Scripts Removed: []
Authorization: "customer review required"
Coverage: {"complete": true, "external_script_bodies": {"complete": 2, "total": 2}, "final_url": "https://shop.example/checkout", "issues": [], "security_header_names_evaluated": ["content-security-policy", "x-frame-options"], "security_headers_observed": ["content-security-policy"], "static_document_content_encoding": "identity", "static_document_media_type": "text/html", "static_document_observed": true, "static_document_sha256": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"}

Snapshot SHA-256: 48f7a2678b19e2e233ff4a2f131e0c564c3d85126d39852c3165792075f4586b

Checkpoints available for external custody

A checkpoint stored only beside its chain is not an external anchor. A real buyer must keep exported copies somewhere Tessera cannot rewrite.

Through record 1 at 2026-08-01T13:00:00+00:00

c31cb885e5840a10c3b1c89a32def4fed7d224557504a30b4a1cbed48e06fcbe

Alerting boundary

Requirement 11.6.1 asks for a mechanism that alerts personnel. This service performs the detection and preserves the evidence; it does not send notifications. Poll the status endpoint from your own monitoring and alert when it reports healthy=false, and record who receives that alert — an assessor will ask, and a report nobody reads is not an alert.

Tessera does not notify personnel. Connect the private status endpoint to the customer-owned system that pages designated recipients, and test that routing before relying on it.

Copy-safe Python polling example

PERSONNEL_NOTIFY_COMMAND is an absolute path to your existing notification wrapper; it receives a title argument and compact JSON on standard input.

#!/usr/bin/env python3
# Inject both variables from your scheduler's secret/configuration store:
#   TESSERA_LEDGER_TOKEN
#   PERSONNEL_NOTIFY_COMMAND (absolute path; title arg, JSON on standard input)
import json
import os
import subprocess
import urllib.request

STATUS_URL = 'https://qi.toledotechnologies.com/api/v1/scan/pci-ledger/status'
token = os.environ["TESSERA_LEDGER_TOKEN"]
notifier = os.environ["PERSONNEL_NOTIFY_COMMAND"]
if not os.path.isabs(notifier):
    raise SystemExit("PERSONNEL_NOTIFY_COMMAND must be an absolute path")

def notify(title, payload):
    # Tessera does not notify personnel; this customer-owned wrapper must.
    notifier_environment = os.environ.copy()
    notifier_environment.pop("TESSERA_LEDGER_TOKEN", None)
    subprocess.run(
        [notifier, title],
        check=True,
        env=notifier_environment,
        input=(
            json.dumps(payload, separators=(",", ":"), sort_keys=True) + "\n"
        ).encode(),
    )

try:
    request = urllib.request.Request(
        STATUS_URL,
        headers={
            "Accept": "application/json",
            "Authorization": f"Bearer {token}",
        },
    )
    with urllib.request.urlopen(request, timeout=20) as response:
        status = json.load(response)
    if not isinstance(status, dict):
        raise ValueError("unexpected status response")
except Exception:
    notify(
        "Tessera ledger status unavailable",
        {"reason": "status_endpoint_unavailable"},
    )
    raise

needs_review = (
    status.get("operational_healthy") is not True
    or status.get("period_compliant") is not True
    or status.get("changes_detected") != 0
)
if needs_review:
    fields = (
        "operational_healthy",
        "period_compliant",
        "changes_detected",
        "monitor_status",
        "last_evaluation",
        "next_evaluation",
        "consecutive_failures",
    )
    notify(
        "Tessera ledger needs qualified review",
        {field: status.get(field) for field in fields},
    )

Scope and limitations

This report is software-generated evidence for qualified human review. It does not determine PCI DSS compliance and does not replace a QSA assessment. It observes the served static document, a defined set of security-impacting HTTP response headers, and retrievable script bodies. It does not execute JavaScript, so runtime-inserted scripts remain outside its view. An allowed-domain finding is an exact comparison to the host list the customer declared; it is not an independent judgment of business authorization. Each evaluation states whether that bounded scope was complete.

Assessor-facing plain-text rendering

The production viewer exposes this printable form and structured JSON from the same report builder.

══════════════════════════════════════════════════════════════════════════════
PCI DSS v4.0.1 REQUIREMENT 11.6.1 — PAYMENT PAGE EVIDENCE RECORD
══════════════════════════════════════════════════════════════════════════════
Page monitored : https://shop.example/checkout
Monitor ID     : synthetic-monitor
Report produced: 2026-08-05T12:00:00+00:00
Period covered : 2026-08-01T12:00:00+00:00  ->  2026-08-04T12:00:00+00:00
Evaluations    : 2
Monitor status : active
Next evaluation: 2026-08-07T12:00:00+00:00
Run failures   : 0 consecutive

──────────────────────────────────────────────────────────────────────────────
1. EVIDENCE INTEGRITY — VERIFIED
──────────────────────────────────────────────────────────────────────────────
all records verified
  Records checked : 2
  Algorithm       : sha256
  Head hash       :
    b95abfad0a1eb65eb7bc215997b46ba0aa48c8cc49fe918871631888579e8f9d
  The private JSON export includes canonical payload bytes and the expected
  hash for every record, so the chain can be recomputed independently.

  Each record's committed fields link to the one before it with a SHA-256
  hash, so altering or deleting them breaks the chain and is detectable. New
  records include assessor-facing detail in that commitment; mutable detail
  from the legacy format is omitted and graded as unknown. This proves the
  history is internally consistent. It does not by itself prove the whole
  history was not regenerated: anyone holding the data could rebuild a
  consistent chain. A checkpoint rules that out only when someone outside this
  service retains and later compares a copy. Local checkpoint rows are useful
  for comparison, but this report does not call them verified external
  custody.

──────────────────────────────────────────────────────────────────────────────
2. EVALUATION INTERVAL — MET
──────────────────────────────────────────────────────────────────────────────
Every evaluation occurred within 7 days of the previous one.

──────────────────────────────────────────────────────────────────────────────
3. OBSERVATION COVERAGE — COMPLETE
──────────────────────────────────────────────────────────────────────────────
Every recorded evaluation completed the bounded observation scope.
  Latest static document : observed
    SHA-256: dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd
  Latest response format  : text/html; encoding=identity
  Latest final URL: https://shop.example/checkout
  Latest selected headers: 1 present of 2 evaluated;
    present=['content-security-policy']
  Latest external bodies : 2 of 2 hashed in full

  A complete evaluation received a non-empty HTML/XHTML payment-page response
  with identity content encoding, hashed its exact bytes, fingerprinted the
  selected security-impacting response headers, inventoried every script
  element within the parser limit, and hashed every retrievable external
  script body in full within the size/count limits. Partial means at least one
  of those observations was unavailable; it is recorded as a finding, not a
  clean run.

──────────────────────────────────────────────────────────────────────────────
4. CHANGES DETECTED AND FINDINGS — 1
──────────────────────────────────────────────────────────────────────────────
  · alert — record 2 at 2026-08-04T12:00:00+00:00
      event: Synthetic external script added
      scripts_added: ['https://cdn.vendor.example/pay-v2.js']
      scripts_removed: []
      authorization: customer review required
      coverage: {'complete': True, 'static_document_observed': True,
        'static_document_sha256':
        'dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd',
        'static_document_media_type': 'text/html',
        'static_document_content_encoding': 'identity', 'final_url':
        'https://shop.example/checkout', 'security_header_names_evaluated':
        ['content-security-policy', 'x-frame-options'],
        'security_headers_observed': ['content-security-policy'],
        'external_script_bodies': {'complete': 2, 'total': 2}, 'issues': []}

──────────────────────────────────────────────────────────────────────────────
5. CHECKPOINTS AND EXTERNAL CUSTODY — 1 LOCAL
──────────────────────────────────────────────────────────────────────────────
A checkpoint listed here is available from Tessera's database. An exported_to
label records an intended or reported destination; it is not proof that an
independent custodian received, retained, or verified the checkpoint. Compare
this export with a copy held outside Tessera before claiming external custody.
  · local copy through record 1 at 2026-08-01T13:00:00+00:00
      c31cb885e5840a10c3b1c89a32def4fed7d224557504a30b4a1cbed48e06fcbe

──────────────────────────────────────────────────────────────────────────────
6. ALERTING — WHO GETS TOLD
──────────────────────────────────────────────────────────────────────────────
Requirement 11.6.1 asks for a mechanism that alerts personnel. This service
performs the detection and preserves the evidence; it does not send
notifications. Poll the status endpoint from your own monitoring and alert
when it reports healthy=false, and record who receives that alert — an
assessor will ask, and a report nobody reads is not an alert.

══════════════════════════════════════════════════════════════════════════════
CONCLUSION
══════════════════════════════════════════════════════════════════════════════
The record of 2 evaluation(s) is intact, verifiable, and was maintained within
the seven-day evaluation interval throughout.

This report is software-generated evidence for qualified human review. It does
not determine PCI DSS compliance and does not replace a QSA assessment. It
observes the served static document, a defined set of security-impacting HTTP
response headers, and retrievable script bodies. It does not execute
JavaScript, so runtime-inserted scripts remain outside its view. An
allowed-domain finding is an exact comparison to the host list the customer
declared; it is not an independent judgment of business authorization. Each
evaluation states whether that bounded scope was complete.
══════════════════════════════════════════════════════════════════════════════