Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ADR-052: Persisted receipts and explicit verification assurance

Date: 2026-10-12 Status: Accepted (design; implementation tracked separately) Author: Rômulo Febasi

Context

INV-8 currently skips because receipts are export-only. Report signing is optional when no key exists; skipped checks do not fail the basic report. A dashboard/CI must not collapse this into a universal green assurance verdict.

Decision

Persist signed governed-transition receipts and introduce explicit basic, strict-local and strict-team verification profiles. Preserve compatible v1 readers/behavior and introduce a versioned report extension/schema only with migration tests. Strict profiles fail when any required assurance component is absent, skipped or invalid.

Consequences

  • Positive: operators can see exactly which surfaces/ranges were verified.
  • Negative: receipt persistence, historical trust evidence and migration require sustained tests.
  • Compatibility: ordinary local/basic checks remain useful with honest partial coverage.
  • Limit: integrity, identity/authority and semantic diagnostics are different report dimensions; none guarantees world truth.

Alternatives considered

  • Make every legacy check mandatory immediately: breaks existing unsigned/local workspaces and v1 consumers.
  • Keep treating skipped checks as universally sufficient: incompatible with a team assurance claim.
  • Put ML outputs into deterministic signed verdicts: confuses reproducible evidence with probabilistic assessment.
  • Add a standard envelope only: serialization does not create missing receipts or trust evidence.

Implementation contract

Receipt contents include transition/payload/source/context digests, actor/device binding, authorization/roster revision, accepted time, algorithm/key ID and signature. Preserve retrievable signing/witness material under policy. Authenticate against pinned trusted keys/authorities; a public key supplied with a report alone is not a trust root.

Basic: report actual checks, missing evidence and limited covered range. Strict-local: require sealed transition coverage, receipts and trusted local signing evidence from the baseline. Strict-team: additionally require scoped subject/key bindings, historical acceptance grant, valid revocation/freshness evidence and selected independent witness/checkpoint. Current authority for a new approval is revalidated online by the collaboration authority; old-signature validity is a separate historical question.

Any missing required evidence fails strict mode with a stable reason/exit code. Report explicit exclusions for pending, embeddings/enrichment and opaque agent behavior. Support a policy-pinned verifier and golden canonical vectors. A receipt-store check replaces INV-8 Skip only when actually implemented; older workspaces show migrated coverage, not invented completeness.

Use native receipts plus an in-toto predicate envelope when useful; DSSE/in-toto encoding and verification require conformance fixtures. C2PA remains a separate evidence-gated option under existing SYN-320, not a required change in this design.

References

Standard serialization implementation

SYN-320 adds separate opt-in in-toto Statement v1 and DSSE export/verification. The subject digest identifies actual immutable exported native artifact bytes; head hashes and filenames are not substituted for byte digests. Collection and native policy verification share one writer lease. Public selected trust/witness material, originals, skips and exclusions remain explicit. Native v1 consumers and their default behavior are preserved.

The independent conformance proof computes SHA/PAE in Python and verifies the actual CLI signature with OpenSSL, checks mutation/overwrite denial, and compares the CLI/MCP payloads. Outer authenticity and subject integrity are separate from native source revalidation, organizational authority and general semantics.