Download evidence for an expert witness

docs://recipes/download-evidence-for-a-perito — fetch the signed constancia and the evidence zip

Use when the lawyer needs the proof of a notification for a court filing, the other party or an
expert witness (perito). The zip is what a perito verifies independently, without Notificado.
The memorial for the juzgado is a different file: docs://recipes/draft-a-memorial.
The files never travel inside a tool answer (a zip can run to tens of MB): over MCP you
learn each file's name, size and SHA-256 and the one HTTP call that downloads it. Learning that
records nothing; every download is recorded (audit log + an evidence event), so do not download
"just to look".

1. whoami({})
   → orgId, scopes
   scopes lack "evidence:read"? Stop: the token cannot download evidence.
   skip if you already hold orgId

2. manage_resource({resource:"notifications", action:"getNotification", params:{orgId:"<orgId>", notificationId:"<notification.id>"}})
   → status, timeline[]
   status is not "sent"? No constancia exists yet — stop and say when to try again.
   X_NOT_FOUND? Wrong id or another firm's; get it with docs://recipes/check-a-notification-status step 2.

3. manage_resource({resource:"evidence", action:"evidenceDownloadInfo", params:{orgId:"<orgId>", notificationId:"<notification.id>", kind:"constancia|zip"}})
   → filename, bytes, sha256, zipVersion, fetch {method, path, body}
   Call it once with kind "constancia" (the signed PDF) and once with kind "zip". Nothing is recorded.
   X_CONSTANCIA_NOT_FOUND? It is issued once delivery events arrive — try again later, stop now.
   X_EVIDENCE_ZIP_NOT_READY? It is still being built — retry once after 30 seconds, then stop.
   Newest version by default; add version:<n> to params only when the lawyer asks for an older one.

4. Download each file over HTTP, where the download is recorded: send fetch.method to
   https://www.notificado.co + fetch.path (POST /v1/download-evidence) with the header
   Authorization: Bearer <the token you use for MCP> and fetch.body as the JSON body, unchanged
   (it pins the version). The answer is JSON: filename, sha256, bytes, contentBase64.
   Decode contentBase64 straight to a file named filename; do not read it into the conversation.
   No way to make an HTTP request from here? Tell the lawyer instead: the notification's page in
   the panel, https://www.notificado.co/notificaciones/<notification.id>, downloads both files
   from its constancia card. Give them the two sha256 values from step 3 to compare.

5. Check that the SHA-256 of each saved file equals the sha256 of step 3 — if not, discard it and
   report; never hand over bytes that do not match.

Done when the lawyer has both files and both hashes.

Tips
- The zip contains the original .eml, the attachments, raw provider events, RFC 3161 timestamp
  tokens (.tsr), the constancia and offline verification instructions (verificar.js). A perito
  needs nothing else and no account.
- Give the lawyer the sha256 values in writing; they are what a court filing cites.
- Anyone can check the PDF later with docs://recipes/verify-a-constancia.
- A re-issued constancia supersedes the older version; both stay valid records.