{
  "schema": "davisville-receipt-envelope-contract.v1",
  "version": "1.0.0",
  "publisher": {
    "name": "Davisville Labs",
    "canonicalUrl": "https://davisvillelabs.com/",
    "schemaUrl": "https://davisvillelabs.com/agents/davisville-receipt-envelope.v1.schema.json",
    "trustContractUrl": "https://davisvillelabs.com/agents/trust.json",
    "deliveryContractUrl": "https://davisvillelabs.com/agents/delivery-contract-v1.json",
    "deliveryInputSchemaUrl": "https://davisvillelabs.com/agents/davisville-delivery-check-input.v1.schema.json",
    "deliveryResultSchemaUrl": "https://davisvillelabs.com/agents/davisville-delivery-check-result.v1.schema.json"
  },
  "purpose": "Provide one privacy-minimized, portable envelope that binds a bounded machine request to authorization context, counterparty/reversibility checks, non-secret payment state, delivery state, evidence references, outcome, freshness, lineage, and integrity without replacing any product-native result or receipt.",
  "canonicalization": {
    "id": "davisville-receipt-canonical-json.v1",
    "rules": [
      "The digest projection removes verification.contentDigest, verification.signature.coveredContentDigest, and verification.signature.value before canonicalization.",
      "Object member names are sorted lexicographically at every object depth.",
      "Arrays preserve their existing order.",
      "The projection is serialized as UTF-8 JSON with no insignificant whitespace.",
      "Receipt-envelope numeric values intended for portable verification use integers; monetary values use integer minor units.",
      "The SHA-256 digest is calculated over the canonical UTF-8 bytes of the digest projection."
    ],
    "digestScope": "envelope_without_verification_contentDigest_signature_coveredContentDigest_and_value"
  },
  "sections": {
    "issuer": "Identifies the organization and product that produced the envelope. It does not by itself prove publisher identity.",
    "subject": "Identifies the bounded subject of the operation without requiring private buyer identity.",
    "operation": "Names the exact operation and result-contract version/schema.",
    "request": "Binds the envelope to a per-invocation request identifier and a canonical request digest. Raw request bodies are not carried.",
    "authorization": "Carries a bounded authorization state or reference, such as a ScopeProof receipt, without claiming issuer legitimacy beyond the referenced contract.",
    "counterparty": "Carries a bounded payee/counterparty consistency state or reference, such as a PayeeProof receipt.",
    "reversibility": "Carries a bounded exit/reversibility state or reference, such as an ExitProof receipt.",
    "payment": "Carries non-secret challenge/attempt/settlement state. Settlement proves settlement only.",
    "delivery": "Carries declared-result-contract delivery state, result digests/references, and optional Davisville Delivery contract/conformance metadata. It measures deterministic result-contract delivery, not subjective quality, factual truth, legal fulfillment, refund entitlement, merchant honesty, counterparty identity, or authority.",
    "outcome": "Carries the product-native bounded outcome status, billability, reason codes, and uncertainty state.",
    "evidenceReferences": "References evidence/proof artifacts without embedding payment secrets or private payloads.",
    "freshness": "Keeps evaluation time, evidence cutoff, and currentness state explicit.",
    "lineage": "Links predecessor/related receipt identities without implying buyer identity.",
    "verification": "Provides content integrity and optional signature metadata. A valid signature proves integrity under the referenced key, not factual truth, legitimate authority, merchant solvency, or safety."
  },
  "stateSemantics": {
    "authorization": [
      "not_checked",
      "within_scope",
      "outside_scope",
      "review_required",
      "unknown",
      "not_applicable"
    ],
    "counterparty": [
      "not_checked",
      "consistent",
      "conflict",
      "review_required",
      "unknown",
      "not_applicable"
    ],
    "reversibility": [
      "not_checked",
      "reversible",
      "conditionally_reversible",
      "irreversible",
      "review_required",
      "unknown",
      "not_applicable"
    ],
    "payment": [
      "not_required",
      "challenge_issued",
      "attempted",
      "settled",
      "failed",
      "unknown"
    ],
    "delivery": [
      "not_attempted",
      "delivered",
      "partial",
      "mismatch",
      "failed",
      "unknown"
    ],
    "outcome": [
      "success",
      "partial",
      "rejected",
      "abstained",
      "failed",
      "unknown"
    ],
    "uncertainty": [
      "none",
      "known_gaps",
      "unknown"
    ],
    "freshness": [
      "current",
      "stale",
      "cutoff_limited",
      "unknown",
      "not_applicable"
    ],
    "signature": [
      "not_provided",
      "present"
    ]
  },
  "normativeRules": [
    "The product-native specialist result remains authoritative for domain semantics; the receipt envelope is additive.",
    "Payment state and delivery state are separate and must never be inferred from one another.",
    "A settled payment must not strengthen evidence confidence, authorization confidence, counterparty confidence, or factual outcome confidence.",
    "A delivered result may still be partial, mismatched, stale, uncertain, or substantively negative according to the product-native result.",
    "A signature proves integrity under a key and only the claims explicitly covered by the signed digest or token.",
    "Unknown, abstained, partial, stale, and mismatch states remain explicit and must not be normalized into success.",
    "Request identity is per invocation; deterministic artifact identity, dossier identity, and reusable evidence identity remain separate.",
    "Receipt references and payment references use non-secret identifiers or digests. Credentials, shared-payment tokens, authorization headers, private keys, wallet secrets, card secrets, and raw buyer payloads are prohibited.",
    "Evidence references do not imply that the referenced evidence proves more than its own product contract states.",
    "An additive receipt-envelope failure must not create a second charge or erase an otherwise successfully delivered product-native result.",
    "When delivery.contract and delivery.conformance are present, delivery.conformance.state must equal delivery.state and the Delivery metadata must be derived from the exact product-native result being enveloped.",
    "Delivery offer and check digests bind the declared deterministic result contract and observed delivery metadata; they do not prove factual truth or subjective result quality.",
    "Public capability and verification claims must reflect currently deployed behavior and must not be inferred from source-control or implementation state."
  ],
  "prohibitedMaterial": [
    "raw prompts",
    "arbitrary request bodies",
    "arbitrary result bodies",
    "Authorization header values",
    "cookies",
    "shared payment tokens",
    "payment credentials",
    "card numbers",
    "CVC/CVV values",
    "private keys",
    "seed phrases",
    "wallet private material",
    "long-term raw IP addresses",
    "buyer identity not required by the product contract"
  ],
  "nonGuarantees": [
    "The envelope is not legal advice, a guarantee of compliance, or a guarantee of refundability.",
    "A valid content digest detects mutation but does not authenticate the publisher.",
    "A valid signature authenticates only to the extent the verifier trusts the referenced key and key-distribution path.",
    "Authorization state does not prove the authority issuer was legitimate unless a separate contract establishes that fact.",
    "Counterparty consistency does not prove merchant quality, solvency, delivery, or absence of fraud.",
    "Reversibility state does not guarantee a merchant will honor an exit path.",
    "Settlement does not prove successful delivery.",
    "Delivery conformance does not prove subjective usefulness beyond the declared deterministic result contract."
  ]
}