Scope
Following references in notes recovered from Rohan Mehta's desk to a file "aro_nexusBridge_v2.py," a court order was obtained for forensic extraction of PaySpark's GitHub Enterprise instance and internal firewall logs.
GitHub Repository — Deletion Event
| File | Repository | Last Committed | Deletion Timestamp | Deleted By (Account) |
|---|
| aro_nexusBridge_v2.py | payspark-internal/fraud-engine | 4 days prior | Thursday 22:47 | aro_cto |
File Content — Recovered from Git History
# aro_nexusBridge_v2.py
import requests, json
from payspark.fraud_engine import FraudModel
ENDPOINT = "https://api.nexpay.sg/v2/external/ingest"
API_KEY = "NXP-2024-████████████████"
def bridge_output(transaction_batch):
scores = FraudModel.evaluate(transaction_batch)
requests.post(ENDPOINT, json=scores, headers={"X-API-Key": API_KEY})
Firewall Log — "aro_nexusBridge" Folder
The firewall access log for the aro_nexusBridge directory shows a gap: all entries between 18:30 and 21:05 on Thursday are absent. The system's own integrity log records this gap was created at 20:52 using maintenance mode. Root-level maintenance mode access is restricted to the IT Systems Administrator role.
Maintenance Mode Access — Role Restriction
Root-level maintenance mode is restricted by system policy to a single role designation: IT Systems Administrator. Activation cannot be performed remotely and requires physical presence at a terminal on the affected floor. PaySpark HR records confirm one individual currently holds this designation. Personnel identity is available on request from HR.
GitHub Account — "aro_cto"
The GitHub account "aro_cto" deleted the repository file. This account is registered in PaySpark's internal identity management system. The full username and employee mapping are subject to a separate access request currently pending with PaySpark's external counsel. Records are expected within 5 business days.