The receipt, specified.
Evidence only counts if anyone can read it. This page is the receipt’s shape, published as an open format: the fields, the guarantees, the query. Use it. We would rather the industry share one evidence record than rent ten proprietary ones.
What one record holds.
Every governed operation emits one receipt: today the decision receipt for what deployed software did; the change receipt for what an agent built is the v1 shape, gathered into one row from records the line already writes. Field names may still move before v1; the shape is the commitment. Fields marked proposed are part of the v1 shape and not yet emitted; every other field is on the record today. v0.1 is published as this page, and the machine-readable schema is published beside it: receipt.schema.json.
| field | what it holds | the guarantee |
|---|---|---|
| id · ts | the receipt’s identity and moment | unique, ordered, never reused |
| change proposed | the human-facing change number this receipt belongs to; today the join is the correlation id | the query key: one lookup returns the whole story |
| work_order proposed | the governed unit of intent: who asked, what scope was granted; today intent and scope ride on the command and its authorization decision | nothing enters the line anonymously |
| actor | the human or service behind the request, with role | authority recorded at the edge it was exercised |
| operation | the registered capability that ran, at its version | declared on the map before first use |
| context[] | every reference the agent worked from: id, version, content hash | pinned before drafting; what the AI saw, at the versions it saw |
| agent | model, prompt version and the exact rendered prompt, commit SHA · proposed: reasoning ref, confidence, alternatives weighed | the instruction preserved verbatim, not recalled |
| code | commit, path, line: a frozen permalink to what executed | resolves after every refactor since |
| checks[] | each policy gate: name, policy revision, result | enforced before effect: a failed check means no effect and no approval requested |
| approval | name, role, timestamp, and the why, verbatim | durable: survives restarts, redeploys, years |
| effect | what changed: writes, versions moved, events emitted | downstream of here, nothing is generated, only read |
| seal proposed | content hash, chained to the previous receipt’s hash | today: append-only, enforced below the application by database trigger and by role; the hash chain is proposed for v1 |
| pack[] proposed | the exhibits this receipt feeds: security review, exam evidence, controls matrix | every exhibit drawn from receipts the system already emits |
Four properties, or it isn’t a receipt.
History can’t be rewritten.
The record is append-only, enforced below the application: database triggers refuse UPDATE and DELETE, and the serving role cannot lift them. Chaining each receipt to the one before it by hash is proposed for v1; the guarantee today is the append-only store and the disposal receipts it emits. The record is designed to be examined by someone who doesn’t trust you.
Everything resolves, years later.
Code, prompts, and context are referenced by content: the exact line that ran, the exact instruction given. Not by names that drift as the system evolves.
No effect without a name.
State changes carry a recorded approval: a person, a role, a moment, and the why. Agents build, investigate, and propose. People approve what changes reality.
Yours, in the open.
Receipts export in open, queryable formats and outlive any vendor, including us. Evidence that lives inside one vendor’s walls is a tenant, not a record.
CHG-2417, the record itself.
The same governed change shown across this site, as the machine holds it. Fixture data; the shape is the point.
{
"id": "rcpt_01J9…", "ts": "2026-07-24T14:14:09Z", "change": "CHG-2417",
"work_order": { "id": "WO-0093", "scope": ["rating.client-config.write"] },
"actor": { "id": "program-manager", "role": "rating:request" },
"operation": "rating.update_loss_cost",
"context": [
{ "ref": "config@v7", "hash": "e41c9b…" },
{ "ref": "filed-rate/FR-TX-2024-118", "band": [1.38, 1.61] }
],
"agent": { "model": "claude-opus", "prompt": "rating_change_v4@a3f9c2",
"confidence": 0.96, "alternatives": [{ "value": 1.52, "rejected": "experience-mod tolerance" }] },
"code": { "commit": "repo@b52e88", "path": "rating/loss_cost.py#L88" },
"checks": [
{ "name": "stay-in-scope", "policy": "scope.yml@r14", "result": "pass" },
{ "name": "filed-rate-conformance", "policy": "rates.yml@r9", "result": "pass" }
],
"approval": { "name": "Dana Reyes", "role": "underwriting-operations-lead", "ts": "2026-07-24T14:13:52Z",
"why": "loss-cost multiplier +9%, within the filed band; hazard group C unchanged" },
"effect": { "writes": ["loss_cost 1.42→1.55", "rating_rules v7→v8"], "events": ["rating.updated"] },
"seal": { "hash": "9d41f2…", "prev": "c07aa1…" }
}
// the query is one lookup: receipts where change = CHG-2417 — and this comes back, whole.
// proposed for v1, not yet emitted: change, work_order, agent.confidence, agent.alternatives, seal, pack[]Take the files: receipt.schema.json · CHG-2417.json, the approved change · CHG-2418.json, the one that was refused. Proposed fields are marked inside the files.
A record you remember to keep is a diary. A record the build can’t ship without is a standard.
v0.1: a draft, stated out loud.
The shape above is the v1 shape: every field not marked proposed is what our platform emits today; the field names may still move before v1, and we’ll version every change to this page, with a receipt. If you’re an examiner, an auditor, or an engineer who thinks a field is missing: tell us where we’re wrong.
This frame is the shape, not a record our platform emitted. The site is deployed by hand.
24 September 2026.
v0.1 is the published version, with the machine-readable schema and the fixture receipts beside it. Field names may still move before v1; each change to this page is recorded here, with its date.
See a receipt earn its keep.
Bring the workflow you have to build and cannot staff. It ends with the workflow running governed, and every field on the record today filling in, live, on your systems, and the proposed ones as they ship.
Inquiries are answered within one business day, by someone who can answer them.
