{
  "model_version": "1.0",
  "title": "Investigation report · CASE-001",
  "case_id": "CASE-001",
  "generated_at": "2026-10-25T10:21:07.697871Z",
  "notice": "Investigative aid only. This report does not determine responsibility or guilt. All data is fictional.",
  "sections": [
    {
      "id": "scope",
      "title": "Scope and case context",
      "type": "facts",
      "facts": [
        {
          "label": "Case",
          "value": "CASE-001 · Warehouse equipment incident"
        },
        {
          "label": "Summary",
          "value": "Asset EQ-4471 recorded as secured at 21:00 and found missing at 22:00."
        },
        {
          "label": "Incident window",
          "value": "2026-10-10 21:00:00 – 22:00:00 site time (UTC+01:00)"
        },
        {
          "label": "Status",
          "value": "active"
        },
        {
          "label": "Data",
          "value": "Fictional demo case"
        }
      ]
    },
    {
      "id": "evidence",
      "title": "Evidence inventory",
      "type": "table",
      "columns": [
        "ID",
        "Item",
        "Type",
        "SHA-256",
        "Ingested at"
      ],
      "rows": [
        [
          "E-01",
          "Entrance CCTV",
          "video",
          "No file",
          "2026-10-11T09:00:00Z"
        ],
        [
          "E-02",
          "Loading-bay CCTV",
          "video",
          "No file",
          "2026-10-11T09:00:00Z"
        ],
        [
          "E-03",
          "Door alarm audio",
          "audio",
          "No file",
          "2026-10-11T09:00:00Z"
        ],
        [
          "E-04",
          "Door access log",
          "csv",
          "0f0295fbd9ed1f2e272fbb6bf60d7febeeeab30abde921e0096864015b3f7647",
          "2026-10-11T09:00:00Z"
        ],
        [
          "E-05",
          "Inventory event log",
          "csv",
          "4abb9b3f750338d4b418a37d82aa1cfd0c417c6408cacf9d33a4a5d06625ede6",
          "2026-10-11T09:00:00Z"
        ],
        [
          "E-06",
          "Witness statement",
          "pdf",
          "No file",
          "2026-10-11T09:00:00Z"
        ]
      ]
    },
    {
      "id": "timeline",
      "title": "Reconstructed timeline",
      "type": "table",
      "columns": [
        "Event",
        "Source time → Normalized time",
        "Rule applied",
        "Claim state",
        "Source locator"
      ],
      "rows": [
        [
          "EV-001",
          "21:00:00 → 21:00:00",
          "reference_clock",
          "supported",
          "E-05 · row 3"
        ],
        [
          "EV-009",
          "21:09:00 → 21:09:00",
          "reference_clock",
          "contradicted",
          "E-05 · row 7"
        ],
        [
          "EV-011",
          "21:10:00 → 21:10:00",
          "reference_clock",
          "supported",
          "E-01 · timecode 00:14"
        ],
        [
          "EV-012",
          "21:12:00 → 21:12:00",
          "reference_clock",
          "supported",
          "E-04 · row 18"
        ],
        [
          "EV-013",
          "21:14:00 → 21:12:00",
          "clock_offset:-120s (source clock 120s fast); inferred from anchors",
          "supported",
          "E-02 · timecode 00:17"
        ],
        [
          "EV-014",
          "21:16:00 → 21:14:00",
          "clock_offset:-120s (source clock 120s fast); inferred from anchors",
          "supported",
          "E-02 · timecode 00:39"
        ],
        [
          "EV-016",
          "21:16:00 → 21:16:00",
          "reference_clock",
          "inferred",
          "E-03 · timecode 00:52"
        ],
        [
          "EV-017",
          "21:18:00 → 21:16:00",
          "clock_offset:-120s (source clock 120s fast); inferred from anchors",
          "supported",
          "E-02 · timecode 01:17"
        ],
        [
          "EV-018",
          "~21:18:00 → ~21:18:00",
          "reference_clock; approximate ±120s",
          "unresolved",
          "E-06 · page 2, para 3"
        ],
        [
          "EV-020",
          "22:00:00 → 22:00:00",
          "reference_clock",
          "supported",
          "E-05 · row 12"
        ]
      ]
    },
    {
      "id": "conflicts",
      "title": "Conflicts and rules",
      "type": "items",
      "items": [
        {
          "id": "C-01",
          "rule_id": "RULE-DUP-001",
          "type": "copied_record",
          "severity": "high",
          "evidence": "E-04, E-05",
          "explanation": "E-05 row 7 matches E-04 row 18 on badge, door and event code but is stamped 21:09:00 instead of 21:12:00 — before the first person enters at 21:10:00 (E-01). Possible copy or import error; not proof of tampering.",
          "uncertain": "Whether the copy was produced by an import job, a manual edit, or a genuine second event."
        },
        {
          "id": "C-02",
          "rule_id": "RULE-TIME-002",
          "type": "clock_offset",
          "severity": "medium",
          "evidence": "E-02",
          "explanation": "E-02 (Loading-bay CCTV) clock runs 120 s fast, inferred from 2 moments it shares with reference-clock sources: EV-013 at 21:14:00 vs EV-012 (E-04) at 21:12:00, +120 s; EV-017 at 21:18:00 vs EV-016 (E-03) at 21:16:00, +120 s. The estimates agree exactly. 3 events are normalized by -120 s. Original times are preserved.",
          "uncertain": "Whether the offset held outside the anchored moments, and whether each anchor pair really records the same moment."
        },
        {
          "id": "C-03",
          "rule_id": "RULE-CLAIM-001",
          "type": "identity_not_established",
          "severity": "review",
          "evidence": "—",
          "explanation": "No source supports \"The person in E-01 is the holder of badge B-117\" (CL-04).",
          "uncertain": "Who the person is. Appearance on camera does not establish identity."
        }
      ]
    },
    {
      "id": "hypotheses",
      "title": "Alternative hypotheses",
      "type": "items",
      "items": [
        {
          "id": "H-01",
          "question": "Why does E-05 record a door event at 21:09:00?",
          "description": "The copied row is an import artifact",
          "state": "inferred",
          "notes": "Field-for-field match with E-04 row 18 except time; import job log not available."
        },
        {
          "id": "H-02",
          "question": "Why does E-05 record a door event at 21:09:00?",
          "description": "The copied row was edited after export",
          "state": "unresolved",
          "notes": "E-05 has no edit history; this can be neither confirmed nor ruled out."
        },
        {
          "id": "H-03",
          "question": "Why does E-05 record a door event at 21:09:00?",
          "description": "A genuine second door event at 21:09",
          "state": "contradicted",
          "notes": "E-04 has no 21:09 row; E-01 shows no entry before 21:10."
        }
      ]
    },
    {
      "id": "unresolved",
      "title": "Unresolved questions",
      "type": "items",
      "items": [
        {
          "id": "CL-04",
          "statement": "The person in E-01 is the holder of badge B-117",
          "state": "unresolved",
          "rationale": "No source links the person on camera to a badge."
        },
        {
          "id": "CL-06",
          "statement": "EQ-4471 was on the trolley",
          "state": "unresolved",
          "rationale": "The object on the trolley is obscured in E-02."
        }
      ]
    },
    {
      "id": "methods",
      "title": "Methods and limitations",
      "type": "points",
      "points": [
        "Source times are never overwritten. Each event keeps the timestamp exactly as recorded next to its normalized time and the rule that produced it.",
        "Log files (CSV) are parsed deterministically; extraction for video, audio and PDF is simulated in this demo and is labelled as such.",
        "In this demo the E-02 clock offset is declared in the fixture metadata, not inferred from the evidence.",
        "Conflicts come from deterministic rules with stable IDs. A conflict is a prompt for human review, not proof of tampering.",
        "Every claim keeps its state (supported, contradicted, inferred or unresolved); the report does not drop uncertainty to make the timeline look cleaner.",
        "Hypotheses carry no probability score. The system compares evidence; it does not pick a winner.",
        "Results on a small synthetic case say nothing about accuracy on real investigations."
      ]
    },
    {
      "id": "claims",
      "title": "Appendix: Claims assessed",
      "type": "items",
      "items": [
        {
          "id": "CL-01",
          "statement": "The loading-bay door opened at 21:12:00",
          "state": "supported",
          "rationale": "Recorded directly in the access log; no cited source conflicts.",
          "citations": [
            "E-04 (supports) · row 18"
          ]
        },
        {
          "id": "CL-02",
          "statement": "A trolley moved through the bay at 21:14:00",
          "state": "supported",
          "rationale": "Recorded on E-02; time normalized for the 120 s clock offset inferred from two anchors.",
          "citations": [
            "E-02 (supports) · timecode 00:39"
          ]
        },
        {
          "id": "CL-03",
          "statement": "The 21:16 alarm came from the loading-bay door",
          "state": "inferred",
          "rationale": "The alarm audio does not name the door; the link relies on E-03 and E-04 together.",
          "citations": [
            "E-03 (supports) · timecode 00:52",
            "E-04 (supports) · row 18"
          ]
        },
        {
          "id": "CL-04",
          "statement": "The person in E-01 is the holder of badge B-117",
          "state": "unresolved",
          "rationale": "No source links the person on camera to a badge.",
          "citations": [
            "No citation"
          ]
        },
        {
          "id": "CL-05",
          "statement": "A separate door event happened at 21:09:00",
          "state": "contradicted",
          "rationale": "Only the copied row in E-05 records it; the original access log and entrance camera conflict.",
          "citations": [
            "E-05 (supports) · row 7",
            "E-04 (contradicts) · rows 17-18",
            "E-01 (contradicts) · timecode 00:14"
          ]
        },
        {
          "id": "CL-06",
          "statement": "EQ-4471 was on the trolley",
          "state": "unresolved",
          "rationale": "The object on the trolley is obscured in E-02.",
          "citations": [
            "No citation"
          ]
        }
      ]
    },
    {
      "id": "findings",
      "title": "Questions and findings",
      "type": "items",
      "items": [
        {
          "id": "Q-01",
          "question": "In what order were the recorded events between 21:00 and 22:00?",
          "claims": [
            "CL-01 (supported) The loading-bay door opened at 21:12:00",
            "CL-02 (supported) A trolley moved through the bay at 21:14:00",
            "CL-05 (contradicted) A separate door event happened at 21:09:00"
          ],
          "finding": "Not answered",
          "answer": "—",
          "cites": []
        },
        {
          "id": "Q-02",
          "question": "Did the 21:16 alarm come from the loading-bay door?",
          "claims": [
            "CL-03 (inferred) The 21:16 alarm came from the loading-bay door"
          ],
          "finding": "Not answered",
          "answer": "—",
          "cites": []
        },
        {
          "id": "Q-03",
          "question": "Was EQ-4471 taken out on the trolley, and can the evidence say by whom?",
          "claims": [
            "CL-04 (unresolved) The person in E-01 is the holder of badge B-117",
            "CL-06 (unresolved) EQ-4471 was on the trolley"
          ],
          "finding": "Not answered",
          "answer": "—",
          "cites": []
        }
      ]
    },
    {
      "id": "signoff",
      "title": "Sign-off",
      "type": "facts",
      "facts": [
        {
          "label": "Status",
          "value": "Not signed. This report is a working draft."
        }
      ]
    }
  ]
}