The receipt, specified.
Evidence only counts if anyone can read it. This page is the receipt’s shape, published as an open format: the fields, the guarantees, the query. Use it. We would rather the industry share one evidence record than rent ten proprietary ones.
What one record holds.
Every governed operation emits one receipt: a change receipt for what an agent built, a decision receipt for what deployed software did. Field names may still move before v1; the shape is the commitment.
| field | what it holds | the guarantee |
|---|---|---|
| id · ts | the receipt’s identity and moment | unique, ordered, never reused |
| change | the human-facing change number this receipt belongs to | the query key: one lookup returns the whole story |
| work_order | the governed unit of intent: who asked, what scope was granted | nothing enters the line anonymously |
| actor | the human or service behind the request, with role | authority recorded at the edge it was exercised |
| operation | the registered capability that ran, at its version | declared on the map before first use |
| context[] | every reference the agent worked from: id, version, content hash | pinned before drafting; what the AI saw, at the versions it saw |
| agent | model, prompt at its own SHA, confidence, reasoning ref, alternatives weighed | the instruction preserved verbatim, not recalled |
| code | commit, path, line: a frozen permalink to what executed | resolves after every refactor since |
| checks[] | each policy gate: name, policy revision, result | enforced before effect: a failed check means no effect and no approval requested |
| approval | name, role, timestamp, and the why, verbatim | durable: survives restarts, redeploys, years |
| effect | what changed: writes, versions moved, events emitted | downstream of here, nothing is generated, only read |
| seal | content hash, chained to the previous receipt’s hash | append-only and tamper-evident: editing history is itself evidence |
| pack[] | the exhibits this receipt feeds: security review, exam evidence, controls matrix | generated by the system, not compiled by a team |
Four properties, or it isn’t a receipt.
History can’t be rewritten.
Each receipt seals with a hash chained to the one before it. A gap or an edit is visible by construction. The record is designed to be examined by someone who doesn’t trust you.
Everything resolves, years later.
Code, prompts, and context are referenced by content: the exact line that ran, the exact instruction given. Not by names that drift as the system evolves.
No effect without a name.
State changes carry a recorded approval: a person, a role, a moment, and the why. Agents build, investigate, and propose. People approve what changes reality.
Yours, in the open.
Receipts export in open, queryable formats and outlive any vendor, including us. Evidence that lives inside one vendor’s walls is a tenant, not a record.
CHG-2417, the record itself.
The same governed change shown across this site, as the machine holds it. Fixture data; the shape is the point.
{
"id": "rcpt_01J9…", "ts": "2026-07-24T14:14:09Z", "change": "CHG-2417",
"work_order": { "id": "WO-0093", "scope": ["rating.client-config.write"] },
"actor": { "id": "program-manager", "role": "rating:request" },
"operation": "rating.update_loss_cost",
"context": [
{ "ref": "config@v7", "hash": "e41c9b…" },
{ "ref": "filed-rate/FR-TX-2024-118", "band": [1.38, 1.61] }
],
"agent": { "model": "claude-opus", "prompt": "rating_change_v4@a3f9c2",
"confidence": 0.96, "alternatives": [{ "value": 1.52, "rejected": "experience-mod tolerance" }] },
"code": { "commit": "repo@b52e88", "path": "rating/loss_cost.py#L88" },
"checks": [
{ "name": "stay-in-scope", "policy": "scope.yml@r14", "result": "pass" },
{ "name": "filed-rate-conformance", "policy": "rates.yml@r9", "result": "pass" }
],
"approval": { "name": "Dana Reyes", "role": "delivery-lead", "ts": "2026-07-24T14:13:52Z",
"why": "+9%, within the filed band; hazard group C unchanged" },
"effect": { "writes": ["loss_cost 1.42→1.55", "rating_rules v7→v8"], "events": ["rating.updated"] },
"seal": { "hash": "9d41f2…", "prev": "c07aa1…" }
}
// the query is one lookup: receipts where change = CHG-2417 — and this comes back, whole.A record you remember to keep is a diary. A record the build can’t ship without is a standard.
v0.1: a draft, stated out loud.
The shape above is what our platform emits today; the field names may still move before v1, and we’ll version every change to this page, with a receipt. If you’re an examiner, an auditor, or an engineer who thinks a field is missing: tell us where we’re wrong.
See a receipt earn its keep.
Bring the workflow AI should run but can’t be trusted with yet. It ends with the workflow running governed, and every one of these fields filling in, live, on your systems.
No newsletter. No drip sequence. Every request gets a real reply within one business day — from someone who can answer it.
