Receipts and manifests reference
Agent Receipt
Agent receipts use payload schema version 1; the enclosing receipt record also
stores type agent-interpretation, schema version 1, and a checksum of the
canonical payload.
| Field | Type or value | Purpose |
|---|---|---|
| schemaVersion | 1 | Receipt payload contract version. |
| agentRunId | UUID | Agent attempt bound to this receipt. |
| trigger | initial-analysis | monitoring-delta | Why interpretation ran. |
| provider / model | string | Configured inference implementation. |
| status | completed | failed | Terminal attempt state. |
| gateVersionId / evidenceVersionId / capabilitySnapshotId | UUID | Immutable run inputs. |
| evidenceBoundaryChecksum / inputChecksum / outputChecksum | sha256 | null | Integrity bindings; output is null on failure. |
| promptTemplateVersion / toolRegistryVersion / outputSchemaVersion | version | Interpreter contract versions. |
| limits / usage | object | Configured bounds and observed token usage. |
| toolCallSummary | array | Sanitized bounded tool calls. |
| errorCode | normalized code | null | Safe terminal failure. |
| startedAt / completedAt | offset timestamp | Attempt timing. |
Raw prompts, raw provider responses, credentials, private reasoning, and raw tool results are not receipt fields.
Shutdown Gate Manifest
The immutable write preview creates schema
shutdown-gate-manifest/1.0.0. It is not a browser input: the server builds it
from current gate, evidence, capability, contract, artifact, approval, and
application records before allowlisted writes begin.
| Field | Type or value | Purpose |
|---|---|---|
| schemaVersion | shutdown-gate-manifest/1.0.0 | Manifest contract version. |
| gateId / gateVersionId | UUID | Gate and immutable reviewed version. |
| targetUrn / replacementUrn | URN | Retirement subject and confirmed replacement. |
| objective / deadline / conditions | values | Declared decision scope and predicates. |
| evidenceBoundaryChecksum | sha256 | Declared evidence boundary binding. |
| sourceEvidenceVersionId / evidenceVersionId | UUID | Pre-application and freshly observed evidence. |
| capabilitySnapshotId / capabilitySnapshotChecksum / capabilityAuthorityChecksum | UUID / sha256 | Connection and current-actor authority binding. |
| ruleVersion | shutdown-gate/1.0.0 | Deterministic evaluator version. |
| contractId / contractChecksum | UUID / sha256 | Supported consumer contract. |
| artifactRecordId / artifactChecksum | UUID / sha256 | Exact accepted artifact. |
| approvalId / approvalChecksum | UUID / sha256 | Accountable human decision. |
| applicationEvidenceId / applicationChecksum | UUID / sha256 | Verified application record. |
| plannedWrites | array | Ordered allowlisted writes and expected checksums. |
| monitoringPolicy | object | Cadence and consecutive-failure threshold. |
| result | open-under-current-evidence | Bounded outcome represented by the manifest. |
| limitations | string[] | Explicit unsupported claims and evidence limits. |
The manifest checksum covers the complete canonical payload. Before writing, Payne rejects a stale gate version, evidence version, capability or authority binding, contract, artifact, approval, application record, or preview checksum.
A newer record does not rewrite an older receipt or manifest. Current
deterministic gate rules use shutdown-gate/1.0.0; unsupported schema or rule
versions fail validation instead of being interpreted approximately.