# internal/core/receipt

Package receipt owns the signed classification shared by finalization and verification.

## SchemaVersion

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## SignatureAlgorithm

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## SnapshotModeWorkingTree

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## SnapshotModeBaseDelta

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## IndependenceLevelIsolationOnly

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## IndependenceLevelCrossVendor

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## IndependenceLevelHumanOverride

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## IndependenceDowngradeSameVendor

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## IndependenceDowngradeUnknownHost

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## IndependenceDowngradeUnknownReviewer

```go
const (
	// SchemaVersion is the current signed receipt schema.
	SchemaVersion = 1
	// SignatureAlgorithm is the detached-signature algorithm name.
	SignatureAlgorithm = "ed25519"
	// SnapshotModeWorkingTree signs the default working-tree snapshot mode.
	SnapshotModeWorkingTree = "working_tree"
	// SnapshotModeBaseDelta signs base-to-head delta snapshot mode.
	SnapshotModeBaseDelta = "base_delta"
	// IndependenceLevelIsolationOnly records isolated review without proven model-vendor separation.
	IndependenceLevelIsolationOnly = "isolation_only"
	// IndependenceLevelCrossVendor records proven different model-vendor review.
	IndependenceLevelCrossVendor = "cross_vendor"
	// IndependenceLevelHumanOverride records explicit operator authority, not model review.
	IndependenceLevelHumanOverride = "human_override"
	// IndependenceDowngradeSameVendor records same-vendor isolation-only review.
	IndependenceDowngradeSameVendor = "same_vendor"
	// IndependenceDowngradeUnknownHost records missing host-vendor detection.
	IndependenceDowngradeUnknownHost = "unknown_host"
	// IndependenceDowngradeUnknownReviewer records missing reviewer-vendor detection.
	IndependenceDowngradeUnknownReviewer = "unknown_reviewer"
)
```

## CanonicalBody

```go
func CanonicalBody(body Body) ([]byte, error)
```

CanonicalBody returns deterministic sorted-key JSON for a receipt body.

## CanonicalJSON

```go
func CanonicalJSON(value any) ([]byte, error)
```

CanonicalJSON returns compact deterministic JSON with lexicographically sorted object keys.

## ClassifyIndependence

```go
func ClassifyIndependence(reviewerProvider, hostAgent string) Independence
```

ClassifyIndependence derives the actual reviewer separation, ignoring caller claims.

## DecodeEnvelope

```go
func DecodeEnvelope(data []byte) (Envelope, error)
```

DecodeEnvelope parses a receipt envelope from JSON.

## ReceiptDigest

```go
func ReceiptDigest(body Body) (string, error)
```

ReceiptDigest returns the hex sha256 digest used by the ledger chain. The digest excludes the detached signature and clears ledger\_head to avoid making the head recursively depend on itself.

## ValidateBody

```go
func ValidateBody(body Body) error
```

ValidateBody checks required receipt body fields.

## ValidateEnvelope

```go
func ValidateEnvelope(envelope Envelope) error
```

ValidateEnvelope checks the body and detached signature shape.

## ValidateReviewCoverage

```go
func ValidateReviewCoverage(body Body) error
```

ValidateReviewCoverage requires every signed file digest to be accounted for: either shown to the independent reviewer (present in reviewed\_context\_provenance) or explicitly declared withheld (ignored\_unreviewed). A digest that is in neither would let a signed pass receipt imply the reviewer saw bytes it never did, breaking the accountability guarantee that the receipt covers the reviewed change set.

## Acceptance

```go
type Acceptance struct {
	ID                 string `json:"id"`
	PhaseID            string `json:"phase_id,omitempty"`
	Command            string `json:"command,omitempty"`
	ExpectedKind       string `json:"expected_kind,omitempty"`
	Status             string `json:"status"`
	Reason             string `json:"reason,omitempty"`
	ExitCode           int    `json:"exit_code,omitempty"`
	OutputSHA256       string `json:"output_sha256,omitempty"`
	EvidenceSHA256     string `json:"evidence_sha256,omitempty"`
	EvidenceActor      string `json:"evidence_actor,omitempty"`
	EvidenceRecordedAt string `json:"evidence_recorded_at,omitempty"`
	Diagnostic         string `json:"diagnostic,omitempty"`
}
```

Acceptance records one acceptance command result included in the receipt.

- `ID: string` (json:"id"): 
- `PhaseID: string` (json:"phase_id,omitempty"): 
- `Command: string` (json:"command,omitempty"): 
- `ExpectedKind: string` (json:"expected_kind,omitempty"): 
- `Status: string` (json:"status"): 
- `Reason: string` (json:"reason,omitempty"): 
- `ExitCode: int` (json:"exit_code,omitempty"): 
- `OutputSHA256: string` (json:"output_sha256,omitempty"): 
- `EvidenceSHA256: string` (json:"evidence_sha256,omitempty"): 
- `EvidenceActor: string` (json:"evidence_actor,omitempty"): 
- `EvidenceRecordedAt: string` (json:"evidence_recorded_at,omitempty"): 
- `Diagnostic: string` (json:"diagnostic,omitempty"): 

## Blocker

```go
type Blocker struct {
	ID         string `json:"id"`
	Severity   string `json:"severity,omitempty"`
	Location   string `json:"location,omitempty"`
	Summary    string `json:"summary,omitempty"`
	Validation string `json:"validation,omitempty"`
}
```

Blocker is a calibrated open reviewer finding.

- `ID: string` (json:"id"): 
- `Severity: string` (json:"severity,omitempty"): 
- `Location: string` (json:"location,omitempty"): 
- `Summary: string` (json:"summary,omitempty"): 
- `Validation: string` (json:"validation,omitempty"): 

## Body

```go
type Body struct {
	SchemaVersion             int               `json:"schema_version"`
	TaskID                    string            `json:"task_id"`
	SessionID                 string            `json:"session_id"`
	Verdict                   string            `json:"verdict"`
	SnapshotMode              string            `json:"snapshot_mode"`
	BaseRef                   string            `json:"base_ref,omitempty"`
	BaseCommit                string            `json:"base_commit"`
	HeadCommit                string            `json:"head_commit"`
	Scope                     []string          `json:"scope"`
	TreeSHA                   string            `json:"tree_sha"`
	FileDigests               map[string]string `json:"file_digests"`
	IgnoredUnreviewed         []string          `json:"ignored_unreviewed"`
	ReviewedContextProvenance []Provenance      `json:"reviewed_context_provenance"`
	Reviewer                  Reviewer          `json:"reviewer"`
	HostUnderReview           HostUnderReview   `json:"host_under_review"`
	Independence              Independence      `json:"independence"`
	SpecFingerprint           string            `json:"spec_fingerprint"`
	AcceptanceDeclared        bool              `json:"acceptance_declared"`
	Acceptance                []Acceptance      `json:"acceptance"`
	OpenBlockers              []Blocker         `json:"open_blockers"`
	MutationGuard             MutationGuard     `json:"mutation_guard"`
	LedgerHead                string            `json:"ledger_head"`
	MintedAt                  string            `json:"minted_at"`
}
```

Body is the canonical receipt payload signed by the host.

- `SchemaVersion: int` (json:"schema_version"): 
- `TaskID: string` (json:"task_id"): 
- `SessionID: string` (json:"session_id"): 
- `Verdict: string` (json:"verdict"): 
- `SnapshotMode: string` (json:"snapshot_mode"): 
- `BaseRef: string` (json:"base_ref,omitempty"): 
- `BaseCommit: string` (json:"base_commit"): 
- `HeadCommit: string` (json:"head_commit"): 
- `Scope: []string` (json:"scope"): 
- `TreeSHA: string` (json:"tree_sha"): 
- `FileDigests: map[string]string` (json:"file_digests"): 
- `IgnoredUnreviewed: []string` (json:"ignored_unreviewed"): 
- `ReviewedContextProvenance: []Provenance` (json:"reviewed_context_provenance"): 
- `Reviewer: Reviewer` (json:"reviewer"): 
- `HostUnderReview: HostUnderReview` (json:"host_under_review"): 
- `Independence: Independence` (json:"independence"): 
- `SpecFingerprint: string` (json:"spec_fingerprint"): 
- `AcceptanceDeclared: bool` (json:"acceptance_declared"): 
- `Acceptance: []Acceptance` (json:"acceptance"): 
- `OpenBlockers: []Blocker` (json:"open_blockers"): 
- `MutationGuard: MutationGuard` (json:"mutation_guard"): 
- `LedgerHead: string` (json:"ledger_head"): 
- `MintedAt: string` (json:"minted_at"): 

## DetachedSignature

```go
type DetachedSignature struct {
	Alg   string `json:"alg"`
	KeyID string `json:"key_id"`
	Sig   string `json:"sig"`
}
```

DetachedSignature is stored outside the canonical signed receipt body.

- `Alg: string` (json:"alg"): 
- `KeyID: string` (json:"key_id"): 
- `Sig: string` (json:"sig"): 

## Envelope

```go
type Envelope struct {
	Body      Body              `json:"body"`
	Signature DetachedSignature `json:"signature"`
}
```

Envelope carries a receipt body and its detached signature.

- `Body: Body` (json:"body"): 
- `Signature: DetachedSignature` (json:"signature"): 

## HostUnderReview

```go
type HostUnderReview struct {
	Agent     string `json:"agent"`
	Model     string `json:"model,omitempty"`
	SessionID string `json:"session_id,omitempty"`
}
```

HostUnderReview identifies the host agent whose work is being gated.

- `Agent: string` (json:"agent"): 
- `Model: string` (json:"model,omitempty"): 
- `SessionID: string` (json:"session_id,omitempty"): 

## Independence

```go
type Independence struct {
	Level      string `json:"level"`
	Distinct   bool   `json:"distinct"`
	Downgraded string `json:"downgraded,omitempty"`
	Reason     string `json:"reason,omitempty"`
}
```

Independence records the separation between the host and reviewer.

- `Level: string` (json:"level"): 
- `Distinct: bool` (json:"distinct"): 
- `Downgraded: string` (json:"downgraded,omitempty"): 
- `Reason: string` (json:"reason,omitempty"): 

## MutationGuard

```go
type MutationGuard struct {
	Status string   `json:"status"`
	Scope  []string `json:"scope,omitempty"`
	Reason string   `json:"reason,omitempty"`
}
```

MutationGuard records the workspace mutation safety result.

- `Status: string` (json:"status"): 
- `Scope: []string` (json:"scope,omitempty"): 
- `Reason: string` (json:"reason,omitempty"): 

## Provenance

```go
type Provenance struct {
	Kind   string `json:"kind"`
	Path   string `json:"path,omitempty"`
	SHA256 string `json:"sha256,omitempty"`
	Bytes  int    `json:"bytes,omitempty"`
}
```

Provenance records one reviewed context source.

- `Kind: string` (json:"kind"): 
- `Path: string` (json:"path,omitempty"): 
- `SHA256: string` (json:"sha256,omitempty"): 
- `Bytes: int` (json:"bytes,omitempty"): 

## Reviewer

```go
type Reviewer struct {
	Provider       string `json:"provider"`
	OverrideReason string `json:"override_reason,omitempty"`
	Model          string `json:"model,omitempty"`
	BinarySHA256   string `json:"binary_sha256,omitempty"`
	EndpointHost   string `json:"endpoint_host,omitempty"`
}
```

Reviewer records the independent reviewer runtime stamped into the receipt.

- `Provider: string` (json:"provider"): 
- `OverrideReason: string` (json:"override_reason,omitempty"): 
- `Model: string` (json:"model,omitempty"): 
- `BinarySHA256: string` (json:"binary_sha256,omitempty"): 
- `EndpointHost: string` (json:"endpoint_host,omitempty"): 

## ValidateOverride

```go
func (r Reviewer) ValidateOverride() error
```

ValidateOverride requires the operator decision to accompany human authority.