The receipt

Proof of what the machine did.

Every decision at the Gate becomes a receipt: which machine asked, what it tried, which rule matched, who said yes, and what happened. It is signed and is designed to join a record that can only grow, so anyone can check it, and a change after the fact shows.

Draft formatDesigned for SCITT and COSE

What is on it

Everything a claim needs. Nothing it doesn't.

A receipt is designed to hold hashes, bands and identifiers, and not your prompts, request bodies or a customer's name. The detail stays with you, and comes out only if a claim needs it.

dw-rc-000003Draft format

who acted

agented25519:4be1c09a77d2f310of this tab's throwaway key

tenantsha256:faebe60772c5983aof "tenant salt 1"

Who acted

The machine's own key, and your company as a salted hash. The receipt names your company as a salted hash, never in plain text.

what it tried

classMONEY.OUT

callPOST /v1/refunds

targetsha256:c6de3b0f9b680709of "salt 1 + order 88412"

band1k to 10k USD

What it tried

The class of action, the call, a hash of the target and a band for how much was at stake.

with what

model askedyour-model-alias

model answeredyour-model-2026-09-30

toolsha256:16f5d3d258bc48bbof "salt 1 + create_refund schema"

With what

The model it asked for and the exact version that answered, because names can quietly point to a new model. And a hash of the tool it used, so a changed tool shows.

how it was decided

tierA

rulemoney.out v3

decisionheld, approved

approversha256:10a9cae9bdf79e84of "salt 1 + billing lead"

How it was decided

Which tier enforced it, the rule and its version, the decision, and a hash of who approved.

what happened

status200

responsesha256:f2823b75fc383accof "salt 1 + refund ok"

parentsha256:8b3bf073e9424bf6of "previous receipt 1"

What happened

The answer from the system it touched, and a link to the receipt before it, so a cut in the chain shows.

sha-256 Signed

A draft format on a throwaway key.

Try to forge one

Change one byte. Watch it break.

This receipt was signed in your tab a moment ago. Change the amount, the approver or the rule and the signature fails. Put it back and it verifies again.

Amount

Approved by

Rule

Checking the signature in this tab.

band: 1k to 10k USD
approved: a salted hash
rule: money.out v3
sha-256: computing
signature: checking Checking

Verify one yourself

Don't trust us. Check it.

Here is a whole receipt: what it says, its signature, and the public key that made it. Edit anything you like. The check runs in this tab, against the key the receipt carries, and nothing is sent anywhere.

Receipt

Spacing doesn't matter. Any value does.

Making a receipt.

Signing a receipt in this tab with a throwaway key.

sha-256: none yet
key: none yet
signature: none yet

A draft format on a throwaway key. Real receipts are meant to be checked for their place in the log.

The record

A record designed to only grow.

Every receipt is designed to join an append only log. Each new entry is folded into a running fingerprint of everything before it, so taking one out, or slipping one in later, shows to anyone who kept an earlier fingerprint.

Designed for open standardsMeant to be an IETF SCITT signed statementidentifiable and non-repudiable Statement about an Artifact signed by an Issuer IETF, RFC 9943 (SCITT architecture) Read the source with a COSE receipt that proves its place in the log.prove properties of a Verifiable Data Structure IETF, RFC 9942 (COSE receipts) Read the source The demos here use a simpler JSON draft.
WitnessedWe plan to ask outside parties, including whoever pays a claim, to countersign the log's fingerprint. None have agreed yet.
Checkable by anyoneA receipt, its proof and a public key will be enough. No account, no call to us.

A tall stack of white ceramic receipt cards.

Cover is meant to pay on the receipt.

See the cover plan Become a design partner