The packet is a ZIP of plain HTML, CSV, JSON, and text files with no scripts, no remote assets, and no source rows, so it can be opened from a shared drive years later by a person who has never heard of this workbench.
Human-readable records
A summary page states the review title, the two files, their digests, the finding counts by severity, and the freeze point. Alongside it sit a method page and a limitations page, so the boundary travels with the evidence instead of living only on this website. A notes file carries whatever the reviewer wrote in their own words.
Registers
Column profiles for both files, the pairing table, committed mappings, consumer policies, findings, dispositions, and the full event history are written as CSV. Every cell is escaped, and any value that begins with a spreadsheet formula character is neutralised so that opening a register in a spreadsheet cannot execute anything.
Machine-readable continuity
A comparison JSON holds the structured findings. A checkpoint JSON holds the entire project and can be loaded back into the workbench to continue the review. A manifest lists every file with a SHA-256 checksum, so a recipient can verify that nothing in the bundle changed since the freeze.
Worked example
Freezing the bundled sample produces a packet whose findings register has twenty-eight rows, six of them at blocking severity, and whose summary names both files with their digests. The checkpoint inside it restores the same two profiles, two mappings, and two consumer policies, which is the fastest way to hand a colleague a review they can actually continue rather than re-key.
Deliberately absent
The packet contains no source rows, no raw example values, no credentials, no executable scripts, no remote fonts or images, and no tracking pixels. It is inert by construction. That is the point: a review artifact that needs a live application to be readable is a review artifact that expires.
Method and limits
Checksums prove the bundle is internally consistent; they are not signatures and do not prove who made it. The packet describes structure, so it cannot substitute for the source files themselves in an audit that needs values.
Do this in the app
Open the workbench and go to the Packet view. Freeze a review point, then export. The download is a single ZIP; open summary.html first.
Related reading
- The full worked exampleThe review that produces this packet.
- Evidence that survivesCheckpoints, amendments, and the event log.
- Privacy boundaryWhat leaves the browser, and when.