{
  "leak_id": "a6bc58f0-5bb0-4252-932d-66af0a40afe8",
  "generated_at": "2026-08-31T03:55:50Z",
  "document_name": "CNSA_Migration_Roadmap.pdf",
  "matched_user": {
    "user_id": "FNB-U1076",
    "name": "Robert Walsh",
    "email": "robert.walsh@fnbank.com",
    "department": "Risk Management"
  },
  "watermark_id": "04a61fd3-5cf0-444f-bf26-d6a5c6f6078f",
  "issued_at": "2026-08-09T03:15:00Z",
  "detected_at": "2026-08-21T03:15:00Z",
  "detected_by": "Partner disclosure",
  "recovery_channel": "Public paste site",
  "confidence": 94.1,
  "algorithm": "ML-DSA-87",
  "signature_bytes": 4627,
  "signature_snippet": "n2CkXwbgUfENNZch9NyhBw+A86C7ETw8...",
  "verification": "VALID",
  "status": "CONFIRMED",
  "chain_of_custody": [
    {
      "at": "2026-08-09T03:15:00Z",
      "event": "Watermark issued",
      "detail": "Payload bound to robert.walsh@fnbank.com and signed with ML-DSA-87."
    },
    {
      "at": "2026-08-09T03:19:00Z",
      "event": "Document released",
      "detail": "Copy delivered to recipient through the managed document portal."
    },
    {
      "at": "2026-08-21T03:15:00Z",
      "event": "Leak observed",
      "detail": "Copy recovered from: Public paste site."
    },
    {
      "at": "2026-08-21T03:17:00Z",
      "event": "Watermark extracted",
      "detail": "Embedded payload recovered at 94.1% confidence."
    },
    {
      "at": "2026-08-21T03:18:00Z",
      "event": "Signature verified",
      "detail": "ML-DSA-87 verification returned VALID against the issuance ledger."
    }
  ],
  "simulated": true,
  "product": "QMark — Primum & Terminus"
}