A receipt proves which contract the runtime evaluated, at which version and hash, against which observations, and what the verdict was. Ed25519 signs it, so anyone checks it offline without trusting the dashboard.

A receipt carries references to evidence, never raw provider payloads. It names the skill version, the provider API version, the evidence levels used, and the time of verification.

What does a receipt look like?

A VERIFIED receipt for stripe.refund.succeeded. The build signed this document with the public core test key and verified it.
{
  "schema_version": "1.0.0",
  "id": "rc_01ARZ3NDEKTSV4RRFFQ69G5FB1",
  "issued_at": "2026-09-05T14:03:26.006Z",
  "issuer": "provely-runtime",
  "operation_id": "op_01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "intent": {
    "statement": "Refund the charge to the customer."
  },
  "contract": {
    "id": "stripe.refund.succeeded",
    "version": "1.0.0",
    "hash": "83491ff981adfd05086d9b90d93e6cdb6cfccafa5554e296b732e5dc0486e7c6"
  },
  "skill": {
    "service": "stripe",
    "skill_version": "0.1.0",
    "certification": "community"
  },
  "versions": {
    "provider_api_version": "2026-08-26",
    "runtime_version": "0.1.0"
  },
  "verdict": {
    "verdict": "VERIFIED",
    "terminal": true,
    "reason_code": "all_conditions_satisfied",
    "reason": "The evidence satisfies every condition of the contract.",
    "evidence_levels_used": [
      "E2"
    ]
  },
  "observations": [
    {
      "id": "obs_readback_1",
      "kind": "observation",
      "channel": "refund_readback",
      "evidence_level": "E2",
      "independence": "provider_readback",
      "digest": "723aefd14209efcc53cbc32bc3fa445e141470a1a1855283cd57bf5a40ffdc0e",
      "observed_at": "2026-09-05T14:03:26.004Z"
    }
  ],
  "attempt_count": 3,
  "verified_at": "2026-09-05T14:03:26.005Z",
  "signature": {
    "algorithm": "ed25519",
    "canonicalization": "jcs",
    "key_id": "provely-test-key-1",
    "public_key": "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
    "value": "83e03aeb99c05e4f97d9abf50dec9d87c2aa4345b82fe28d25e97b73f266ee8aa95f9e913ce26391a718f676be26e1ec30bebeb8ca79cd1292d5f464e4a59007",
    "payload_sha256": "800af02aa9a9809f9edcaa2f54f16c8378ecd9eed92b30e8f50b059c00a7442c"
  }
}

How do I validate a receipt offline?

Validate a receipt with the CLI

  1. Install the CLI.Download the provely static binary for Linux, macOS, or Windows, or run npx provely.
  2. Put the trusted keys in the configuration.The validator needs a key map that you control. It maps a key id to a public key. A receipt that verifies against its own embedded key proves nothing.
  3. Run the validator.Run provely receipt validate receipt.json. The exit code is the verdict code: 0 VERIFIED, 2 PENDING, 3 FAILED, 4 CONTRADICTED, 5 UNVERIFIABLE. An invalid receipt gives 1.
  4. Gate on the exit code.A pipeline step passes only on a valid VERIFIED receipt. A valid PENDING receipt is not done.
The validator output
$ provely receipt validate rc_01ARZ3NDEKTSV4RRFFQ69G5FB1.json

contract hash    ok
canonical json   ok
signature        ok  key provely-test-key-1
key trusted      ok  from your key map
evidence claim   ok  E2 present on one observation

verdict          VERIFIED
exit 0

This receipt names the skill stripe at version 0.1.0, certification community, and the contract stripe.refund.succeeded at version 1.0.0. Those are the values of the signed skill package that this site renders. Read the stripe verification page.

Which checks does the validator run?

  1. The document validates against receipt.schema.json.
  2. The canonical JSON of the document without the signature member hashes to signature.payload_sha256.
  3. The Ed25519 signature verifies against the public key.
  4. The key id maps to that public key in your trusted key map.
  5. A VERIFIED verdict declares one evidence level above E0, and every declared level appears on an observation reference.
  6. A VERIFIED component names the channel that supports it.

The conformance fixtures carry four forgeries. One is signed by a rogue key. One holds a tampered verdict with a repaired digest. One claims VERIFIED and carries no observation. The TypeScript, Python, and Rust validators reject all of them with the same reason codes.

A receipt states the contract hash in contract.hash. The published receipt schema requires a VERIFIED receipt to carry one observation reference with an evidence level of E1 or higher.

Source: Provely core schemas · retrieved 2026-09-05

Does a receipt contain the provider response?

No. It holds a reference to each observation: a digest, a channel, an evidence level, and a time. Raw evidence stays optional, encrypted, and short-lived.

Can a receipt say VERIFIED on the agent word alone?

No. The receipt builder and the schema reject a VERIFIED claim whose evidence levels are absent, empty, or E0 only.

Why is canonical JSON needed?

Three languages must sign and verify identical bytes. RFC 8785 fixes member order, number formatting, and string escaping. The fixtures cover the traps: -0, 1e-7, and UTF-16 code unit order.