feat(execute): bind Seal fields on the evidence receipt - #32
Merged
Conversation
The receipt stays ExecuteEvidenceReceiptV1. It now carries program version, admission, environment, runner, oracle tier, and nonce so a consumer can treat it as a Seal without a second format. verified requires oracle tier 2.
abrichr
added a commit
that referenced
this pull request
Aug 29, 2026
A partner implements channel plus read (API, DB, file, ack, or a second session). Production Execute receipts require oracle tier 2 or 3. Visual and OCR (tier 0) cannot mint VERIFIED. Stacked on #32 so both gates stay fail-closed: observed strength cannot be visual, and oracle_tier must match it. Merged by an agent session, not the founder.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Opened by an agent session, not the founder.
Reader
A types reviewer who can merge this before Cloud consumes the receipt. Check the new required fields and the
verifiedoracle-tier gate.What this does
ExecuteEvidenceReceiptV1is the Seal. It is not a second format.The receipt now binds the program version (
workflow_version), admission (qualification_id), environment, runner, independent-effect tier (oracle_tier), outcome, and a per-receiptnonce, plus the bundle hash it already had.verifiedandrolled_back_verifiedrequireoracle_tier2 or 3. Tier 2 is a system-of-record read. Tier 0 (visual) and tier 1 (second-session UI) cannot mint a production success.oracle_tiermust matchobserved_effect_strength, so a caller cannot claim SoR after a screenshot check.Local unsigned replay stays outside this contract. Execute is the invoke path that issues the receipt.
Reviewer checks
_receipt()fixtures still parse.verifiedreceipt withindependent_sessionobserved strength is refused.execute-v1-openapi.jsonincludes the new required fields.This does not mint a signing key. HMAC on the webhook still signs the envelope. A production Seal still waits on B47 Action 1.