The receipt, specified.

Status

Version 1.1, July 2026. This document is normative for every receipt The AI Factory emits. The reference verifier is the normative implementation — if prose and code disagree, the code wins. v1.1 adds external anchoring(below): chain heads are timestamped at an RFC 3161 authority the issuer does not control, removing the residual “issuer signs its own history” trust assumption that v1 stated openly.

The receipt object

{
  "body":      { ... },   // plain JSON — the claim being sealed
  "bodyHash":  "hex",     // SHA-256 of canonicalize(body)
  "prevHash":  "hex",     // bodyHash of the org's previous receipt
                          // (genesis = 64 zero characters)
  "signature": "hex"      // Ed25519 over UTF-8 "${prevHash}.${bodyHash}"
}

Receipts are per-organization hash chains: each receipt’s prevHashmust equal the previous receipt’s bodyHash. Signing the pair binds both the content and its position in history — the past cannot be quietly rewritten, and history cannot be retroactively signed.

Canonicalization

Bodies are canonicalized with RFC 8785 (JCS) semantics for the emitted JSON subset: object keys sorted lexicographically by UTF-16 code unit, no insignificant whitespace, arrays kept in order, undefined members dropped. Plain JSON types only — no dates, no binary, no NaN.

Verification procedure

1. Canonicalize body; SHA-256 it; compare to bodyHash. 2. Verify the Ed25519 signature over the UTF-8 string `${prevHash}.${bodyHash}`against the issuer’s public key (which travels in every verify response). 3. For a chain segment, additionally check each link’s prevHash against its predecessor. All three checks run offline, on a laptop, with no account:

curl -s https://theaifactory.dev/api/verify/RECEIPT_ID > receipt.json
curl -sO https://theaifactory.dev/spec/verify.mjs
node verify.mjs receipt.json
# → { "bodyIntact": true, "signatureValid": true, "verified": true }

Receipt types in production

knowledge.ingested (a source entered the brain, content-hashed) · brain.answer (an answer with its retrieval set) · brain.analytics (question + generated SQL + result hash + source hash — the number was computed, not guessed) · brain.routine (an autonomous run with its declared autonomy level sealed in the body) · connections.verified (live integration probes and their results) · skill.birth (a skill’s content hash, approver, and autonomy level at adoption) · chain.anchor (an external timestamp over the chain head — below) · governed.action (one receipt spanning trigger → retrieval set → policy gate → action → outcome, the autonomy level sealed inside). Types are open-ended; the envelope above never changes within v1.

External anchoring (v1.1)

A self-signed chain has one honest objection left: the issuer holds the key, so the issuer could rewrite history and re-sign all of it. Anchoring answers it with a party we don’t control. A checkpointof the chain head is canonicalized (JCS), hashed (SHA-256), and submitted to an RFC 3161 trusted timestamping authority; the TSA’s signed token is sealed into a chain.anchor receipt on the same chain. Because every signature covers `${prevHash}.${bodyHash}`, one anchored head fixes the entire history below it in third-party time.

// checkpoint (JCS-canonicalized, then SHA-256 → the timestamped digest)
{
  "v": "chain-anchor/v1",
  "org": "…",
  "headReceiptId": "…",
  "headBodyHash": "hex",     // chain head at anchoring time
  "headSignature": "hex",
  "receiptCount": N,
  "generatedAt": "ISO-8601"
}

Verification is deliberately vendor-free — the token is standard CMS, checked with stock openssl. Recompute the checkpoint hash, decode the token from the chain.anchor receipt, then:

# token from the receipt body: base64-decode tsa.tokenB64 → token.tst
openssl ts -verify -digest CHECKPOINT_SHA256 \
  -in token.tst -token_in \
  -CAfile tsa-ca.pem            # the TSA's CA chain (e.g. freetsa cacert.pem
                                #  + "-untrusted tsa.crt" for its signing cert)
# → Verification: OK
# Any altered digest — i.e. any rewritten history — fails.

Rewriting any receipt below an anchor now requires forging the TSA’s signature, not ours. Anchors are minted on the daily cadence and on demand.

Conformance

Test vectors cover a genesis receipt, a chained receipt, a tampered body, and a forged chain position (signed with a throwaway keypair whose private half was discarded at generation). An implementation conforms when it accepts the valid vectors, rejects the invalid ones for the stated reasons, and produces byte-identical canonicalization. Our own CI runs the reference verifier against these vectors on every commit.