A native differential receipt binds a declared checked rule, input context, lowering/evaluation observations, hashes, and contract version in csk.differential-receipt/v0.
Current guarantees
- Structural inspection validates schema and recomputable bindings without re-running policy. Signed-envelope authentication additionally checks consumer trust and pinned context, but still does not re-run policy.
- Native
vouch verify --reexecuteemitscsk.native-reexecution-report/v0: authentication is reported first, then current Native execution under fixed complete-transcript scope, then the current-versus-signed comparison. - Native
vouch gate --require-decisionemits unsigned diagnosticcsk.native-gate-report/v0; the report records whether a live grant was minted but is never itself a capability or accepted gate input. - Replay compares an explicit corpus and records agree, mismatch, and not-comparable outcomes.
- Receipt type tags and required fields are disjoint from Bridge-report tags and fields.
Receipt field groups
| Group | Binds or records | Does not establish |
|---|---|---|
| contract/type | csk.differential-receipt/v0 and schema version | future-schema compatibility |
| source/input | exact checked rule and pinned datum bytes/hashes | correctness or completeness of host data conversion |
| execution | lowering/evaluation transcript and observed result | semantic equivalence outside the checked profile |
| identity | declared generator/version and artifact hashes | authenticity, issuer identity, or timestamp truth |
| verification | schema and recomputable byte bindings | honest generation or policy correctness |
| authentication | authorized signature plus exact source, input, profile, and issuer-engine context | historical execution, freshness, identity, or honest deployment |
| native re-execution | both current Native evaluators agree and their complete canonical transcript equals both signed observations | independent witnessing, authorization, policy correctness, or whole-language equivalence |
| local decision gate | live re-executed evidence exactly matches one required decision in the current Native invocation | transferable authority, freshness, replay prevention, identity, deployment safety, or permission for an external action |
Boundaries
- Hashes establish byte binding and internal consistency, not authenticity or honest generation. Re-execution agreement does not establish freshness, historical execution, independent witnessing, policy correctness, or whole-language equivalence.