Download a signed report of a retained result

A ZIP binding the exact retained result, its complete findings and the facts it records to an Ed25519 signature by Ironfang Finance. The report is in its result's version. A V2 validation, XML or hybrid PDF, gets the V2 manifest (ironfang/finance/einvoice/report-manifest/v2): the input and, for a PDF, its embedded XML by hash; the ruleset release with its family, variant, syntax, scope and manifest checksum (see the ruleset's manifest_sha256); for a hybrid release the PDF engine, PDF/A profiles and binding table it pins; both engines by image digest; every check group and layer; what was not checked; and the release's rule artefacts by hash. A result made through V1 gets exactly the bundle POST /finance/v1/einvoices/reports issues, V1 manifest and all.

The ZIP holds manifest.json (canonical), signature.json, result.json (the retained bytes), findings.json and a readable report.html derived from the manifest; with RFC 3161 timestamps configured, timestamp.tsq and timestamp.tsr too. V2 reports sign under their own domain and envelope schema, so a V1 signature can never be read as V2 or the reverse. Both are signed by the keys at GET /finance/v1/einvoices/reports/keys.

Send operation_id (and, for a V1 generation only, include_pdf) in a JSON body of at most 1024 bytes. A V2 result has no readable PDF: include_pdf on one is 503 report_unavailable. Truncated findings are 422 report_incomplete. Nothing is validated or charged again and nothing is stored; issuance time and signature may differ between downloads of one result, its facts never do. Expiry and deletion are checked again before the bundle is released. A signature does not certify compliance.