How a Casefile works
The lifecycle of a report from submission to closure, and what the Proofline records at each step.
Every submitted report becomes a Casefile with a code like CF-1004. The Casefile holds the original report, the evidence, the conversation, every decision, the reward calculation and the payout. Its full history is the Proofline.
The lifecycle
Every program uses the same state machine. Projects can't invent their own statuses, because consistency is part of the product.
| Status | Meaning | Waiting on |
|---|---|---|
| Submitted | Report received; SLA clock running | Project |
| Acknowledged | The project has seen it | Project |
| In triage | The project is verifying the finding | Project |
| Needs information | A specific question was asked | Researcher |
| Accepted | Valid; impact, severity and reward are set from the locked rules | Project |
| Fix in progress | Remediation underway | Project |
| Retest | A fix is ready for the researcher to verify | Researcher |
| Payout pending | The reward is owed | Project |
| Resolved | Fixed (or Won't Fix) and paid | — |
| Closed | Final | — |
Adverse outcomes follow a separate path with built-in protections:
- Closure proposed: the project cites the rule and gives a reason. The 48-hour rebuttal window opens.
- Rebuttal filed: the researcher's one final response. It doesn't reopen the case automatically.
- Final decision: the project upholds or reverses its decision.
- Mediation: if the decision is upheld, the researcher can ask an independent mediator to review it.
What the Proofline records
Each event stores who acted, their role, the time, and a payload (the reasoning, rule citation, evidence hashes and so on). Each event also includes the hash of the one before it:
hash = sha256(previous_hash | sequence | type | actor | role | time | encrypted_payload)
If any event were edited, removed or reordered, every later hash would stop matching. Every Casefile page shows Proofline verified · N events when the chain checks out. Corrections are recorded as new events, never as edits.
What's fixed at submission
When you submit, Proofline records:
- an immutable timestamp,
- a SHA-256 content hash of the report,
- the rulebook fingerprint of the program version it's bound to,
- the SHA-256 of each attached file.
This matters in priority and duplicate disputes: it's always provable what existed, and when.