{"schema":"steadywrk.receipt-chain/v1","generated_at":"2026-08-14T01:40:02.757Z","build_time":"2026-08-13T23:56:05.066Z","genesis_tag":"STEADYWRK-RECEIPTS-GENESIS-v1","genesis_chain":"0d49369e97cfcf77c14fef3c6175663ad473d286cd423b131f83d0f5d3bf190b","count":21,"head":"392ccb6382b1951cb2dbfe10f37aa426565d986021b9eec4255d8ea56d6d3c7f","algorithm":{"leaf":"receipt_hash = SHA256(canonical_json(receipt)) — canonical_json sorts object keys, no whitespace (equivalently: jq -cS)","link":"chain_n = SHA256(chain_{n-1} | n | ts | receipt_hash), with chain_0 = SHA256(genesis_tag) and ts = receipt.completed (empty string when null)","order":"links are sorted by (ts, phase, receipt_hash) ascending — a total, machine-independent order, so the same receipt set always yields the same head","implementation":"packages/ledger (genesisChain, computeChain) — the same chain functions the foresight seal ledger uses"},"spec":"https://steadywrk.app/spec/receipt-chain","integrity":{"signing":{"enabled":true,"algorithm":"Ed25519","key_id":"receipt-chain-ed25519-v1","public_key_spki_b64":"MCowBQYDK2VwAyEAs7p9TfaWI8zE21UVGE2nF1y1puZuRF2lHV2Fa7VRcJY=","signed_payload_format":"`${count}|${head}` (UTF-8, no trailing newline)","signed_payload":"21|392ccb6382b1951cb2dbfe10f37aa426565d986021b9eec4255d8ea56d6d3c7f","signature_b64":"CdHQCXuekLnbXyua8ng1/ht+WNynFeuVOzlSv9R5Jia2pVJ8ZAdU6ajgfho8E3whygesuHxOIAbO74uZ+yBSBQ=="},"proves":"The head is a pure function of the receipt content published here. Changing any character of any receipt changes the head. You can derive the head yourself from this JSON with curl, jq and sha256sum — no trust in this server or its verdict.","does_not_prove":"That history was never rewritten. A chain served alongside the data it commits to shows internal consistency at this moment; it becomes tamper-evident against us only once you have recorded a head and re-check it later. The signature does not change this: it proves the holder of the pinned key endorsed THIS head, not that the head describes an unedited history. There is still no third-party audit. Each head IS timestamped by two independent RFC 3161 authorities, but those tokens are held in a private repository and you cannot obtain one — treat them as absent until they are published. Note also that the pinned public key can currently only be obtained from this origin, so checking this signature with a key taken from this response proves only that the response agrees with itself.","source":"the same public-safe phase-gate receipt fields served by /api/public/audit-receipts and rendered at /audit-log — no new disclosure"},"verify":{"instructions":"Run the shell below on any POSIX machine with curl, jq and coreutils. It recomputes every leaf and every link from this response alone and compares the result to the published head. Nothing of ours executes.","shell":["curl -sS https://steadywrk.app/api/public/receipt-chain -o chain.json","prev=$(printf '%s' \"$(jq -r .genesis_tag chain.json)\" | sha256sum | cut -c1-64)","for n in $(seq 1 \"$(jq '.links|length' chain.json)\"); do","  ts=$(jq -r \".links[$n-1].ts\" chain.json)","  h=$(jq -cSj \".links[$n-1].receipt\" chain.json | sha256sum | cut -c1-64)","  prev=$(printf '%s|%s|%s|%s' \"$prev\" \"$n\" \"$ts\" \"$h\" | sha256sum | cut -c1-64)","done","[ \"$prev\" = \"$(jq -r .head chain.json)\" ] && echo \"HEAD MATCHES: $prev\" || echo \"MISMATCH\""],"signature_instructions":"Checks the Ed25519 signature over the head against a public key PINNED as a literal in the script below — not against the key served in this response, which would only prove this document agrees with itself. The signed bytes are rebuilt from `count` and `head`; the `signed_payload` field is shown for readability and is never trusted by the check. Node built-ins only, no install, no network once chain.json is saved.","signature_shell":["curl -sS https://steadywrk.app/api/public/receipt-chain -o chain.json","node -e '","  const { createPublicKey, verify } = require(\"node:crypto\");","  const c = require(\"./chain.json\");","  const s = c.integrity.signing;","  if (!s.enabled) { console.log(\"NOT SIGNED — reason: \" + s.reason); process.exit(2); }","  // The pin. Compare this literal against the constant in","  // apps/web/src/lib/receipt-chain.ts and any copy you recorded earlier.","  const PIN = \"MCowBQYDK2VwAyEAs7p9TfaWI8zE21UVGE2nF1y1puZuRF2lHV2Fa7VRcJY=\";","  const key = createPublicKey({ key: Buffer.from(PIN, \"base64\"), format: \"der\", type: \"spki\" });","  const payload = c.count + \"|\" + c.head;   // rebuilt, not trusted","  const ok = verify(null, Buffer.from(payload, \"utf8\"), key,","                    Buffer.from(s.signature_b64, \"base64\"));","  console.log(ok ? \"SIGNATURE OK over \" + payload : \"SIGNATURE INVALID\");","  process.exit(ok ? 0 : 1);","'"],"universal_verifier":"The `shell` and `signature_shell` scripts above are the whole verification: they need only curl, jq, coreutils and Node built-ins, and nothing of ours executes. A single verifier covering every STEADYWRK attestation chain — with PASS / FAIL / CANT_CHECK kept distinct — lives at packages/cli in the source repository; read it there and run it locally rather than fetching it from a package registry.","recheck_later":"Record the head you got, and the count k it was computed over. Re-run later: if the recorded head still appears as links[k].chain, the first k links are byte-for-byte unchanged. If it does not appear anywhere in links[*].chain, something before position k moved — either a receipt was back-dated into the middle (which legitimately re-derives every link after it) or a past receipt was altered. The chain makes the disturbance visible; it does not tell you which of the two it was."},"links":[{"n":1,"ts":"","receipt_hash":"d05f2c8f2e5a02607d916c2784f0491579535e78f8787a86e492c255cb2785bc","chain":"3b82c98484fe84ddb27bacede06ab976167afeebeb21a363df21590dabf50a9c","receipt":{"phase":"phase2-code-surgery","completed":null,"gate_passed":false,"build_hash":null,"metrics_version":"1.2.0","notes":null}},{"n":2,"ts":"2026-04-13T00:00:00Z","receipt_hash":"e8b2ec338fe9fd682ed2c9ba885919030cb40e0fbd5288a254162604197fe3af","chain":"f77d813c91477933049bb79a0e8afed4d89bc8e00ee9c92a2259cc1103edecb8","receipt":{"phase":"sprint-F-connectors","completed":"2026-04-13T00:00:00Z","gate_passed":false,"build_hash":null,"metrics_version":null,"notes":null}},{"n":3,"ts":"2026-04-13T19:04:47Z","receipt_hash":"01dcb8aff52b6e9e4aeaa21fecded6561ac45b8408cd66af4f24031708dec23d","chain":"4407c0d1c7360f7aa6ecc0a22bd53a804e2142df4605cbf89e3f61c783967053","receipt":{"phase":"sprint-A","completed":"2026-04-13T19:04:47Z","gate_passed":true,"build_hash":null,"metrics_version":"1.0.0","notes":null}},{"n":4,"ts":"2026-04-13T19:31:02Z","receipt_hash":"6557d5b1453191a46191ad1a56931439fe5256662ab461f1f8dac9ad4dc48133","chain":"1d723181690db7b111ae75010f8466500c30cfb41331371191ec57ae68e57894","receipt":{"phase":"sprint-B","completed":"2026-04-13T19:31:02Z","gate_passed":true,"build_hash":null,"metrics_version":"1.0.0","notes":null}},{"n":5,"ts":"2026-04-13T19:48:00Z","receipt_hash":"49b477dba1e31babade53b8d1871df0142298ac33e28fe4ae7b2e001040f7372","chain":"5adcdda35f01aa2ce43458af6bcfd014e30859c0ef524e3a101d2aec996c562e","receipt":{"phase":"sprint-C","completed":"2026-04-13T19:48:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.0.0","notes":null}},{"n":6,"ts":"2026-04-13T19:55:00Z","receipt_hash":"4d60f46f0d4ce3f6aa4b6924ec050c09c39607f8c1c3f3802c064bb0bed905a2","chain":"3bcc07c0668d7cd785c2989bdb1010fe2ecdc8de0dbcc6b79aee4e751b8681bd","receipt":{"phase":"sprint-D","completed":"2026-04-13T19:55:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.0.0","notes":null}},{"n":7,"ts":"2026-04-13T23:45:00Z","receipt_hash":"82b626164bbc34e1b3de8cc260b274c89ca5845d67111a7585a49e31a30fc4f4","chain":"5d1fe0848b91183a9473a4e175b7210377ca00b58a9f8020a791eba835114723","receipt":{"phase":"sprint-F-verification","completed":"2026-04-13T23:45:00Z","gate_passed":true,"build_hash":null,"metrics_version":null,"notes":null}},{"n":8,"ts":"2026-04-14T00:00:00Z","receipt_hash":"d86b052117a00bf9c7eb54322f73e9ff3a85d7505454916d9c1679978fff9a0e","chain":"c7a3c70fa70f4789f6f7ab9e256b27396f780b5301e8036e36bde25f4275a24e","receipt":{"phase":"phase-4-probe","completed":"2026-04-14T00:00:00Z","gate_passed":false,"build_hash":null,"metrics_version":null,"notes":null}},{"n":9,"ts":"2026-04-14T00:50:00Z","receipt_hash":"354625fedc4325aa3ddb16b55fd0a5ee1650205c1c32651582a21ce386962854","chain":"35e80b32f2aa633d62e5558e1c7855151108e9ca747b14e2d8de277466425d74","receipt":{"phase":"sprint-F","completed":"2026-04-14T00:50:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.1.0","notes":null}},{"n":10,"ts":"2026-04-14T07:00:00Z","receipt_hash":"70e2519088e78da1c36d17cf90858c40a24f9ab4d7c9f52dd1ed1116541276df","chain":"06b9f3c953e7026bc916b491296af48177467970c0706c603f6f2d41d1b66b5b","receipt":{"phase":"sprint-activation","completed":"2026-04-14T07:00:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.1.0","notes":null}},{"n":11,"ts":"2026-04-14T09:35:06Z","receipt_hash":"22e727ef76711b773f905c9bb1534cc829abb42db64e3bfddb557355bdbfed60","chain":"e14da34983b63464e55027b5419e193b546f270145766be1462ed8ae508ec8a9","receipt":{"phase":"sprint-phase-3","completed":"2026-04-14T09:35:06Z","gate_passed":true,"build_hash":null,"metrics_version":"1.1.0","notes":null}},{"n":12,"ts":"2026-04-14T11:22:00Z","receipt_hash":"853ec9fbafc2049aac2e2462f3622776e08dd56dcb334caf2670923e8587ecbe","chain":"39ef62685c6bba37f3d82037161a5d9940550fb249aba98984932b73f1c4f507","receipt":{"phase":"sprint-phase-4","completed":"2026-04-14T11:22:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.1.0","notes":null}},{"n":13,"ts":"2026-04-14T11:45:00Z","receipt_hash":"2a300bbc1d96824f1d391e07007f574eda9ff812f2e0cbaf5faabc90b551a474","chain":"9f35697ed9e1ffab61a8832d5b8978fa763c96f15cc51ab604002aa9aad6a169","receipt":{"phase":"sprint-activation-phase-2","completed":"2026-04-14T11:45:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.1.0","notes":null}},{"n":14,"ts":"2026-04-14T13:55:00Z","receipt_hash":"267adbbd4787cc4e16a70f4104ac9ef757f37e3af2a693b5b333b84331fbef5b","chain":"bfbf70a2eef43df73ac7b06ac85a8860878f969ea631681e3c42e5d375df3106","receipt":{"phase":"sprint-phase-5","completed":"2026-04-14T13:55:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.1.0","notes":null}},{"n":15,"ts":"2026-04-14T21:10:00Z","receipt_hash":"61064af6b37b807ba25fb6000ea900fbf8fea0a0b4ffa25f3bfc1a60dfe65d6b","chain":"7dd9c138d262b2dd092d57180f11036b316ebf008efc7d0a1e6ca88a2dfde0bf","receipt":{"phase":"sprint-phase-6","completed":"2026-04-14T21:10:00Z","gate_passed":true,"build_hash":null,"metrics_version":"1.1.0","notes":null}},{"n":16,"ts":"2026-04-14T23:09:27Z","receipt_hash":"d734fa80d0826617c554d04a937aba4d3d32efaaefc850f8efe5822458851034","chain":"b1769cd6eda2dfc3308ce0201f21d4712964d0c0cee83683a9f37be0ff1559be","receipt":{"phase":"phase7-wave1","completed":"2026-04-14T23:09:27Z","gate_passed":true,"build_hash":null,"metrics_version":null,"notes":null}},{"n":17,"ts":"2026-04-15T00:00:00Z","receipt_hash":"0f573791913247eb4066e6a2db8dccab28ee46fcc6ce0e3259ce8b408f37bb6a","chain":"7ab624c4a0f6b9beb02bb8c4eefd7957c2ae57153ac4bf35fa120047e95783b8","receipt":{"phase":"phase-6-wave-1-advisor-cascade","completed":"2026-04-15T00:00:00Z","gate_passed":false,"build_hash":null,"metrics_version":null,"notes":null}},{"n":18,"ts":"2026-07-20T19:57:00+03:00","receipt_hash":"2ec8768c28d224d23c067051ae18f9060d49f226d13b760a4a715cb243a51803","chain":"d9636a41297407b20eb32e9d7d79fc4a4a51f07da93632233adecfe6f0d04f33","receipt":{"phase":"surface-086e1e18-fix-1-2-4","completed":"2026-07-20T19:57:00+03:00","gate_passed":false,"build_hash":null,"metrics_version":null,"notes":null}},{"n":19,"ts":"2026-07-23T06:50:00Z","receipt_hash":"40e7a8316770ae19a7a6200081e0397a27c159bfbd0e4f8d6a9b0c31a16ffd71","chain":"a374b764336b0ca29713132019577538551694a977b4be302e592da936ddbf92","receipt":{"phase":"p0-hard-systems","completed":"2026-07-23T06:50:00Z","gate_passed":false,"build_hash":null,"metrics_version":null,"notes":null}},{"n":20,"ts":"2026-07-28T06:50:00Z","receipt_hash":"e4402ced9c2c2499a70f8eb2970fddc072c263d810106f52fa4e5cefe58c2b67","chain":"11381c38733a3fbf9f437f01db527f96028454263abba59612da44925c3a74f7","receipt":{"phase":"email-welcome-from-fix-20260728","completed":"2026-07-28T06:50:00Z","gate_passed":true,"build_hash":null,"metrics_version":null,"notes":null}},{"n":21,"ts":"2026-08-09T12:20:42Z","receipt_hash":"4b8e7e67775127eb3f19c58f4af9a9522d7a140021cc6676b6d49d616da569d3","chain":"392ccb6382b1951cb2dbfe10f37aa426565d986021b9eec4255d8ea56d6d3c7f","receipt":{"phase":"estate-ci-and-environment-hardening","completed":"2026-08-09T12:20:42Z","gate_passed":true,"build_hash":null,"metrics_version":"1.0.0","notes":null}}]}