Assembling a DOL Audit Evidence Package: Deterministic Export, Trace-ID Linkage & Chain Integrity Proof

A Department of Labor Wage and Hour Division records request names an employee and a date range, not a table, and if the response is a one-off manual join across three services under deadline pressure, the resulting package cannot be reproduced identically on a second run — which is itself a finding. This guide builds a deterministic export that turns a (employee_id, start_date, end_date, case_number) request into a sealed evidence package, the response-generation counterpart to the Compliance Audit Trail Design topic within the Core Architecture & Compliance Mapping framework.

Problem Framing

29 CFR Part 516 obligates an employer to keep specific records for non-exempt employees — the classification determined upstream by Mapping FLSA Thresholds for Multi-State Payroll — including hours worked each workday and workweek, the regular rate of pay and how it was derived, and the straight-time and overtime earnings paid for each pay period (29 CFR § 516.2(a)). A WHD investigator’s request is scoped by employee and by date range, not by a query an engineer already has saved, and three failure modes turn that scope into an export that cannot survive scrutiny:

• Non-deterministic query scope. A query with no explicit ordering, paginated against a table that receives concurrent writes, returns a different row set on every run. Handing an auditor a package today and reproducing it identically for internal counsel next week is not optional — it is the first thing a defensible response has to guarantee.
• Missing trace-id correlation. Time punches land in one service, regular-rate derivation in another, overtime computation in a third. Without a shared identifier stamped at ingestion, reassembling “everything that happened for this employee in this pay period” degenerates into fuzzy date-range joins that silently drop or duplicate records.
• No sealed manifest. Even a complete, correctly ordered export is worthless as evidence if nothing proves it was not edited after assembly. The chain-of-custody problem this pattern solves is the direct output of the Building a Checksum Chain for Payroll Events ledger: an export is only as trustworthy as the chain it was pulled from, and pulling from an unverified chain to satisfy a deadline is how a package gets discredited.

These three failures map onto specific NIST SP 800-53 controls an auditor may independently be checking. AU-3 (Content of Audit Records) requires the export to carry enough context to reconstruct each event, not just its final dollar figure. AU-9 (Protection of Audit Information) requires the package to prove it has not been altered since the ledger recorded it. AU-10 (Non-Repudiation) requires the rule version that computed a figure to be provably attached to that figure rather than asserted after the fact. Retention is governed separately by AU-11 alongside the statute itself: 29 CFR § 516.5(a) sets a three-year preservation window for payroll records, and § 516.6(a) sets a two-year window for supplementary basic records such as time cards and work-time schedules — an export request outside those windows is a retention-policy failure, not an assembly bug.

Prerequisites & Data Requirements

Every field below must already exist in the source ledgers before an export request arrives; this stage never derives a fact, it only gathers, verifies, and seals facts recorded earlier. Every monetary and rate value is a Decimal instance end to end — a float anywhere in the payload makes the package hash non-reproducible across runs.

Two preconditions sit outside any single field:

1. The chain is verified before export, not during it. Assembling a package is a read against an already-sealed ledger. If the ledger’s own integrity check has not run — or has failed — the export must refuse to proceed rather than seal an unverifiable snapshot.
2. Every pay period has a trace_id. A period missing the identifier that ties its punches to its rate derivation and its overtime calculation cannot be assembled into one evidentiary unit; it can only be assembled into four unrelated rows an auditor has to trust were about the same week.

Step-by-Step Implementation

Step 1 — Model the request and the ledger event. A frozen LedgerEvent mirrors the checksum-chain shape with two additions: trace_id for cross-service correlation and rule_version for engine provenance.

from __future__ import annotations

import hashlib
import json
import logging
from dataclasses import dataclass
from datetime import date
from decimal import Decimal
from typing import Any

logger = logging.getLogger("payroll.audit.dol_package")

GENESIS_CHECKSUM = "0" * 64
REQUIRED_EVENT_TYPES = frozenset(
    {"TIME_PUNCH", "RRP_DERIVATION", "OT_CALC", "PAYCHECK_ISSUED"}
)


@dataclass(frozen=True)
class LedgerEvent:
    seq: int
    trace_id: str
    employee_id: str
    workweek_start: date
    event_type: str
    rule_version: str
    fields: dict[str, Any]
    checksum: str


@dataclass(frozen=True)
class EvidenceRequest:
    employee_id: str
    start_date: date
    end_date: date
    dol_case_number: str
    requested_by: str

Step 2 — Gather events by trace ID within the window, in a fixed order. Filtering is by employee_id and workweek_start; sorting by (workweek_start, seq) guarantees the same request produces the same row order on every run, regardless of storage-layer pagination. Expected output for a three-week request: a list sorted strictly by week then by sequence, never by insertion time.

def gather_events_for_request(
    ledger: list[LedgerEvent], request: EvidenceRequest
) -> list[LedgerEvent]:
    """Return events for one employee within [start_date, end_date], deterministically ordered."""
    matched = [
        event
        for event in ledger
        if event.employee_id == request.employee_id
        and request.start_date <= event.workweek_start <= request.end_date
    ]
    matched.sort(key=lambda event: (event.workweek_start, event.seq))
    logger.info(
        "dol_package_gather case=%s emp=%s start=%s end=%s matched=%s",
        request.dol_case_number, request.employee_id,
        request.start_date, request.end_date, len(matched),
    )
    return matched

Step 3 — Group by trace ID and assert 29 CFR § 516.2(a) completeness. Each trace_id is one pay period; it must contain all four required record types before it can appear in a sealed package. Expected output: a pay period missing OT_CALC is reported by trace_id, not silently omitted.

def group_by_trace(events: list[LedgerEvent]) -> dict[str, list[LedgerEvent]]:
    grouped: dict[str, list[LedgerEvent]] = {}
    for event in events:
        grouped.setdefault(event.trace_id, []).append(event)
    return grouped


def find_incomplete_traces(grouped: dict[str, list[LedgerEvent]]) -> list[str]:
    """Return trace_ids missing a record type required by 29 CFR 516.2(a)."""
    incomplete = []
    for trace_id, trace_events in grouped.items():
        present = {event.event_type for event in trace_events}
        missing = REQUIRED_EVENT_TYPES - present
        if missing:
            incomplete.append(trace_id)
            logger.info(
                "dol_package_incomplete_trace trace_id=%s missing=%s",
                trace_id, sorted(missing),
            )
    return incomplete

Step 4 — Canonically serialize and compute the package hash. The manifest hash is a function of the request scope and every included event’s own checksum, so re-running the identical request reproduces the identical hash:

$H_{\text{package}} = \mathrm{SHA256}\big(\text{manifest}\big)$

def _default(value: Any) -> str:
    if isinstance(value, Decimal):
        return str(value)
    if isinstance(value, date):
        return value.isoformat()
    raise TypeError(f"unhashable type in evidence payload: {type(value)!r}")


def canonical_serialize(payload: Any) -> bytes:
    """Serialize with sorted keys and no incidental whitespace for reproducible hashing."""
    return json.dumps(
        payload, sort_keys=True, separators=(",", ":"), default=_default
    ).encode("utf-8")

Step 5 — Seal the package. assemble_evidence_package refuses to run against an unverified chain, refuses to seal an incomplete trace, and otherwise produces a manifest plus its SHA-256 package_hash. Expected output: calling this function twice with the same ledger and request returns byte-identical package_hash values.

@dataclass(frozen=True)
class EvidencePackage:
    dol_case_number: str
    employee_id: str
    start_date: date
    end_date: date
    record_count: int
    rule_versions: tuple[str, ...]
    chain_head_checksum: str
    package_hash: str
    records: tuple[LedgerEvent, ...]


def assemble_evidence_package(
    ledger: list[LedgerEvent],
    request: EvidenceRequest,
    full_chain_verified: bool,
) -> EvidencePackage:
    """Assemble a sealed, reproducible evidence package for one DOL request."""
    if not full_chain_verified:
        raise ValueError("refusing to seal a package against an unverified ledger chain")

    matched = gather_events_for_request(ledger, request)
    grouped = group_by_trace(matched)
    incomplete = find_incomplete_traces(grouped)
    if incomplete:
        raise ValueError(f"incomplete evidence for trace_ids: {incomplete}")

    rule_versions = tuple(sorted({event.rule_version for event in matched}))
    chain_head_checksum = matched[-1].checksum if matched else GENESIS_CHECKSUM

    manifest = {
        "dol_case_number": request.dol_case_number,
        "employee_id": request.employee_id,
        "start_date": request.start_date,
        "end_date": request.end_date,
        "record_count": len(matched),
        "rule_versions": rule_versions,
        "chain_head_checksum": chain_head_checksum,
        "record_checksums": [event.checksum for event in matched],
    }
    package_hash = hashlib.sha256(canonical_serialize(manifest)).hexdigest()

    logger.info(
        "dol_package_sealed case=%s emp=%s records=%s package_hash=%s",
        request.dol_case_number, request.employee_id, len(matched), package_hash[:12],
    )
    return EvidencePackage(
        dol_case_number=request.dol_case_number,
        employee_id=request.employee_id,
        start_date=request.start_date,
        end_date=request.end_date,
        record_count=len(matched),
        rule_versions=rule_versions,
        chain_head_checksum=chain_head_checksum,
        package_hash=package_hash,
        records=tuple(matched),
    )

Step 6 — Run it against a sample ledger. Three workweeks, four required record types each, one employee — the minimum shape a real request returns. Expected output: record_count == 12 and a 64-character hex package_hash that is identical every time this cell runs unchanged.

def _hash_of(seed: str) -> str:
    return hashlib.sha256(seed.encode("utf-8")).hexdigest()


sample_ledger: list[LedgerEvent] = []
seq = 0
for week_start in (date(2026, 4, 6), date(2026, 4, 13), date(2026, 4, 20)):
    trace_id = f"TR-E44817-{week_start.isoformat()}"
    for event_type, payload in (
        ("TIME_PUNCH", {"hours": Decimal("44.00")}),
        ("RRP_DERIVATION", {"regular_rate": Decimal("21.36")}),
        ("OT_CALC", {"ot_hours": Decimal("4.00"), "ot_pay": Decimal("128.16")}),
        ("PAYCHECK_ISSUED", {"gross_pay": Decimal("1067.20")}),
    ):
        sample_ledger.append(
            LedgerEvent(
                seq=seq,
                trace_id=trace_id,
                employee_id="E-44817",
                workweek_start=week_start,
                event_type=event_type,
                rule_version="ca-ot-engine-v3.2.1",
                fields=payload,
                checksum=_hash_of(f"{trace_id}:{event_type}:{seq}"),
            )
        )
        seq += 1

request = EvidenceRequest(
    employee_id="E-44817",
    start_date=date(2026, 4, 1),
    end_date=date(2026, 6, 30),
    dol_case_number="WHD-2026-118842",
    requested_by="WHD Investigator J. Alvarez",
)
package = assemble_evidence_package(sample_ledger, request, full_chain_verified=True)
# package.record_count == 12
# package.rule_versions == ("ca-ot-engine-v3.2.1",)
# len(package.package_hash) == 64

Verification

1. Completeness against 29 CFR § 516.2(a). For every trace_id in the requested window, all four record types must be present; find_incomplete_traces must return an empty list before assemble_evidence_package is allowed to seal.
2. Package-hash reproducibility. Call assemble_evidence_package twice against the identical sample_ledger and request and assert package_hash is byte-identical both times. Any drift means ordering, a stray float, or an unsorted key leaked into canonical_serialize.
3. Integrity gate enforced. Call with full_chain_verified=False and assert ValueError is raised before any query executes — the function must fail closed, never seal a package “for now” against an unconfirmed ledger.
4. Boundary: zero matching records. A request for a date range with no ledger activity must return record_count == 0 and a still-valid package_hash over an empty manifest, not an exception — the response to the auditor is “no records exist for this window,” stated affirmatively, not a crash.
5. Reconciliation to the payroll register. Sum gross_pay across every PAYCHECK_ISSUED event in the package and assert it equals the employer’s register total for the same employee and period, using the same register-to-filing reconciliation discipline as Reconciling Form 941 to W-2 Totals — a package that cannot reconcile to the register it was drawn from will not survive investigator scrutiny.
6. Retention-window boundary. Reject a request whose start_date predates the employer’s configured retention floor (three years for payroll records under § 516.5(a), two years for supplementary records under § 516.6(a)) with an explicit “outside retention window” response rather than an empty package that looks like missing evidence.

Failure Modes

• Package hash changes between identical runs. Root cause: the gathering query relied on an unstable sort — insertion order, an unindexed ORDER BY created_at with ties, or offset-based pagination against a table receiving concurrent writes — so two runs of the same request return the same rows in a different order. Remediation: sort exclusively on (workweek_start, seq), both of which are immutable once written, and add a CI test that asserts hash equality across two independent gather-and-seal runs.
• Incomplete trace shipped as if it were complete. Root cause: the overtime engine emitted OT_CALC on a delay, or a service outage dropped a RRP_DERIVATION event, and the export ran before the gap was backfilled, producing a technically-non-empty but evidentially incomplete pay period. Remediation: run find_incomplete_traces as a hard gate, not a warning, and route any incomplete trace_id through the same Manual-Review Queue Escalation SLAs used for other unresolved payroll records, so the gap is closed before the response deadline instead of after.
• Sealed against a chain that was never actually verified. Root cause: full_chain_verified was hardcoded to True at a call site to unblock a deadline, or the chain-verification step was run against a stale ledger snapshot instead of the one being exported. Remediation: compute full_chain_verified immediately before assembly, in the same transaction scope as the gather step, and never accept it as a parameter supplied from outside the assembly call itself.

Frequently Asked Questions

Related

• Building a Checksum Chain for Payroll Events — the tamper-evident ledger this export reads from and must verify before sealing.
• Compliance Audit Trail Design — the parent topic covering audit-trail architecture and retention this export implements.
• Reconciling Form 941 to W-2 Totals — the reconciliation discipline a sealed package’s totals must independently satisfy.
• Mapping FLSA Thresholds for Multi-State Payroll — the exempt/non-exempt determination that decides which employees 29 CFR § 516.2(a) applies to in the first place.