oneproof.dev
home · stage records · samples
Preview artifact, 11 September 2026. Illustrative samples of a record format whose first Internet-Draft is on the datatracker (draft-saha-stage-receipts-00, posted 8 September 2026) and of its forthcoming reference SDK. The draft is a draft, not a standard; the SDK does not exist yet. Nothing here is a released implementation, a stable schema, or a capability claim. It is published for one reason: the Validation Battery says what a conforming implementation must do, and a claim like that is worth more if you can hold something in your hand and check it.

Sample receipts, the reference verifier,
ten rejection vectors

Check them yourself. No network. No key. No account. No call home. A verifier that needs any of those has made you trust someone again, which is the problem this format exists to remove.

Three commands

sha256sum receipts/*.json MANIFEST.json   # our digests, your tool
python3 canonicalize.py receipts/*.json   # is each file its own canonical form?
python3 verify.py MANIFEST.json           # the chain, offline

Or everything, including the rejection vectors: ./run_checks.sh. Expect 103 pass, 0 fail, 4 not-run -> PASS and 10/10 vectors refused. The four not-run are originality checks on records that declare themselves unanchored — the verifier says so, by name, rather than passing them.

One such run, unedited, all 147 lines, for putting yours beside: CHECK_RUN_2026-09-16.txt — ./run_checks.sh on this package, extracted from the tarball above, on 16 September 2026 (Linux, Python 3). The digests it prints in step 1 are the ones in SHA256SUMS; if yours differ, the copy you have is not this package.

Download the whole package: stage-receipts-preview-2026-09-16.tar.gz
sha256 6c832273c28ba0f30bda07a6587068f6a9787690f5c6d6ad31e1920b4ad501bc
Built reproducibly — fixed owner, order and timestamps — so the digest is the same for anyone who rebuilds it from these files.
Supersedes stage-receipts-preview-2026-09-11.tar.gz (sha256 39de2320f81efe802c5e72c6dcbd83dd3a4efe214718a250ce96196787e0437d), which stays at its address rather than being overwritten. One file differs: watch/STATUS.json, where the notes on requirements 5, 7, 9 and 11 were extended after an outside reading. No requirement changed state — whatchanged.py diffs states and will report nothing, which is the correct answer.

What is here

README.mdStart here — what is in the package and the three commands
MANIFEST.jsonThe chain: four ordered digests and the chain head
receipts/01-retrieve · 02-rerank · 03-generate · 04-verify — read the third first; it records a refusal
canonicalize.pyThe canonical form, specified as ~40 lines of runnable code
verify.pyThe reference verifier — ~140 lines, no dependencies, no network
rejection/Ten vectors a conforming verifier must refuse, each with its reason, plus INDEX.json
check_rejections.pyRuns the ten vectors through the verifier and reports each refusal
run_checks.shEverything above, in order
_build.py · _build_rejections.pyHow the samples were generated, so nothing is hand-waved
validation-battery.mdThe acceptance tests the format and its SDK will be held to — published before the code
verifier-specification.mdWhat any independent verifier must do, and must not
watch/STATUS.json — every open requirement and commitment, machine-readable; whatchanged.py to diff it
SHA256SUMSEvery file above, by digest. sha256sum -c SHA256SUMS

Read the third receipt first

receipts/03-generate.json records a refusal. The generator produced no claim that could be bound to a retrieved passage, so the run has no answer — and the receipt says so, in its own outcome class, with a reason. The fourth receipt then records zero claims examined and states how that zero was derived.

That is the sample we would most like you to look at. A format that only records successes is a marketing surface. Nothing to verify is a result, not an absence.

What these samples do not show

Non-linear topology. This chain is linear. Fan-out, fan-in, retries as distinct attempts, branches and loops are an open requirement and are not represented. It is the largest hole, named rather than cropped out. Anchoring. Every receipt declares anchor.state: unanchored; the verifier reports originality as not-run with that reason. These records are consistent with themselves; they are not evidence that they are the records that were made. Signatures. Sequenced behind actor identity; not present. Payload contents. The digests reference bytes not published with the samples; the structure is the point.

Two pre-commitments, made here

The Validation Battery is the acceptance battery the format and its reference SDK will be held to. It is published before the code so it cannot drift toward whatever the code turns out to do, and the reference implementation ships with its results attached, uncurated — every test, including the ones it fails. The Internet-Draft, draft-saha-stage-receipts-00, was posted on 8 September — the second and last under a two-draft discipline. Both are recorded, with a date, in watch/STATUS.json, which you can diff rather than take on trust.

Write the second verifier

One verifier checking one format is a claim. Two independent verifiers agreeing on the same records is evidence. The specification is written so that a second implementation can be built by someone who has never spoken to us. If you write one, publish your results against these samples and the ten vectors — including every place where you and the reference disagree. That disagreement is the most valuable bug report this format can receive.