Overview
Compliance
Section titled “Compliance”Compliance-evidence readback + signed exports (list, get, export). Reads are a classification lens over AuditEventBinding; only classifier-marked exportable kinds appear on the wire. A signed export is signed with the export signing key of the deployment (exportSigning); a deployment without one answers 404 signing-not-configured. It is the same envelope as the audit-bundle and provenance exports, so one verifier reads all three. Redaction happens when evidence is generated, not at the export boundary — records are stored already redacted.