# Forensics UI

Purpose
- Provide timeline exploration, evidence viewing, and attestation verification workflows.

Core surfaces
- Timeline explorer with filters and drilldowns.
- Evidence viewer for attestations, signatures, and DSSE bundles.
- Verifier steps with expected outputs and replay guidance.

Determinism and assets
- Captures and sample payloads must be stored locally with SHA256SUMS.
- Tables and examples use UTC timestamps and stable ordering.

Offline behavior
- Evidence viewer works from offline bundles.
- Verification steps prefer local bundles and recorded hashes.

Troubleshooting
- Error taxonomy, retry guidance, and deterministic repro steps.