The common spine
The spine every edition is built from
Each service delivers its own edition of the pack. Most items appear in all four editions; the deployment runbook and rollback plan appear where implementation is in scope. Every row names its intended audience and its applicability, so nothing has to be assumed.
Production Evidence Pack contents, intended audience, purpose and which engagements include each item| Item | For | Applies to | Purpose |
|---|
| Scope statement & exclusions | Engineering, procurement | Every engagement | Exactly what was covered, what was not, and why. |
|---|
| Findings or design documentation | Engineering, security | Every engagement | Severity-ranked findings (audit) or architecture and design rationale (implementation engagements). |
|---|
| Client verification record | Engineering, QA | Every engagement | The named clients tested, the agreed conditions, and the recorded results — reproducible, not anecdotal. |
|---|
| Residual-risk register | Security, procurement | Every engagement | What remains open at handover, why it was not closed, who owns it, and what would close it. |
|---|
| Deployment runbook & rollback plan | Operations | Implementation engagements | How to deploy the change safely, and the documented path back if something goes wrong. |
|---|
| Security & access record | Security | Every engagement | What access was granted, how credentials were handled, and confirmation of removal at handover. |
|---|
| Methodology & limitations note | Security, procurement | Every engagement | What was examined and what was not — so nobody relies on coverage that was never claimed. |
|---|
The deployment runbook and rollback plan apply where implementation is in scope. The Readiness Audit makes no code change, so it assesses deployment and rollback posture rather than producing those documents. The Enterprise Pilot additionally exercises the rollback in a non-production environment.
The methodology and limitations note matters as much as the findings: it states what was examined and what was not, so nobody relies on coverage that was never claimed.