NYC Local Law 144 requires the applicable bias audit and public Summary of Results; it does not require SHA-256 hashes, JSON manifests or a particular internal evidence-package format. Those are potential Lexara internal integrity and reproducibility controls.
Conceptual evidence package
| Artifact | Purpose | Status |
|---|---|---|
audit_report.pdf | Professional technical audit record | Engagement deliverable |
public_summary.pdf | Publication-ready public results | Supports public disclosure |
results.csv | Structured calculation output | Internal / controlled |
audit_manifest.json | Audit reference, methodology/version, data basis and artifact map | Internal governance control |
evidence_manifest.json | Evidence inventory and provenance | Internal governance control |
checksums.sha256 | Tamper-evident fingerprints for finalized artifacts | Lexara integrity control — not an LL144 requirement |
independence_statement.pdf | Records independence review where used | Professional control |
Why hashes help
A cryptographic hash is a fingerprint of exact bytes. If a finalized file changes, its SHA-256 value changes. That can help detect silent replacement or modification, provided canonicalization and versioning rules are defined consistently.
Public-by-explicit-approval
The public Summary of Results should be generated from a deliberately limited publication payload. Candidate-level data, raw datasets, internal logs, private client references and confidential notes should never become public simply because they exist in the audit record.
Versioning instead of silent overwrite
A finalized audit should not be modified silently. A correction should create a traceable new version or superseding record with its own date, reason and artifact fingerprints.
Where this capability lives
The website explains the control model. The calculation engine, controlled audit platform and publication workflow remain separate systems and should enforce the relevant security, approval and access boundaries.