Evidence status changed

Fires when an existing audit evidence item changes status. This is a status-change event, not a creation event — there is no separate "created" event for audit evidence, so oldStatus and newStatus always describe a transition of an item that already exists.

Ready-to-review signal: a newStatus of READY_FOR_AUDIT means the customer has provided evidence for the item and it is ready for the auditor to review.

When it fires: once per evidence item, each time its status changes. Status can also change on its own as the customer's compliance posture changes, so an item may move from READY_FOR_AUDIT back to NOT_READY_FOR_AUDIT without an explicit auditor action.

Status values:

• NOT_READY_FOR_AUDIT — the item is not yet ready for the auditor; required evidence is missing or does not meet the requirement.
• READY_FOR_AUDIT — the customer has provided the evidence and it is ready for the auditor to review.
• ACCEPTED — the auditor reviewed the item and accepted it.
• FLAGGED — the auditor reviewed the item and flagged an issue for the customer to address; once the customer addresses it the item returns to READY_FOR_AUDIT.
• NA — the item is not applicable to this audit.

A typical lifecycle is NOT_READY_FOR_AUDIT → READY_FOR_AUDIT → ACCEPTED (or → FLAGGED, which returns to READY_FOR_AUDIT once the customer addresses the issue). INITIALIZED is an internal status and is never delivered — oldStatus and newStatus are always one of the values above.