Receipt verification · a reproducible SAMPLE

Inspect the receipt. Try to break it.

Run a complete signed record, change its payload, remove a required witness, and try it without a signature. One pinned verifier makes the decision in each case. You can inspect the code, reproduce the results, and see exactly what they establish.

Download the replay bundle Run the examples Inspect the recorded run

Canonical verifier source: szl-holdings/szl-receipt @ 1467fcbd1ff57b955d588c73e64a541ebc16770f. Contract: GovernedAction v1.

SAMPLE inputs; actual cryptographic checks. Subjects, actor, policy, witness and timestamps are synthetic. The replay generates an ephemeral ECDSA P-256 key in memory and runs the canonical signer and verifier. It never saves a key or contacts a provider. A SAMPLE pass establishes signature math and internal consistency; signer trust, external evidence and authorization remain UNKNOWN.

Four cases. Keep each outcome visible.

SAMPLE · EXPECTED PASS

Complete signed record

Seven required subjects and internally consistent sample evidence. The signature is actually generated and checked. This is a bounded sample result.

SAMPLE · EXPECTED INCOMPLETE

Changed payload

Change the action identifier while keeping the original signature. A structurally valid payload still fails with signature-mismatch.

SAMPLE · EXPECTED INCOMPLETE

Missing witness

Sign a record after removing its runtime witness. A valid signature cannot supply missing evidence. The required witness stays absent.

SAMPLE · EXPECTED INCOMPLETE

No signing key

Emit without a private key. The signatures array stays empty, and the verifier refuses admission. No synthetic signature is substituted.

Run from inspected source

Use Git and CPython 3.11 or 3.12. Download and extract the bundle into a new directory, review the runner and its source lock, then run these PowerShell commands from that directory:

git -c core.autocrlf=false clone --no-checkout https://github.com/szl-holdings/szl-receipt.git receipt-source
git -C receipt-source -c core.autocrlf=false checkout --detach 1467fcbd1ff57b955d588c73e64a541ebc16770f
py -3.11 -m venv .venv
.\.venv\Scripts\python.exe -m pip install --require-hashes --only-binary=:all: -r requirements.lock
.\.venv\Scripts\python.exe -I replay.py --source-dir receipt-source --output my-run.json

The runner checks the exact source revision, every package module and the dependency versions before importing the verifier. A changed source file or an unexpected module stops the replay.

Linux or macOS commands

git -c core.autocrlf=false clone --no-checkout https://github.com/szl-holdings/szl-receipt.git receipt-source
git -C receipt-source -c core.autocrlf=false checkout --detach 1467fcbd1ff57b955d588c73e64a541ebc16770f
python3.12 -m venv .venv
.venv/bin/python -m pip install --require-hashes --only-binary=:all: -r requirements.lock
.venv/bin/python -I replay.py --source-dir receipt-source --output my-run.json

Exit status belongs to the harness. Exit 0 means all four cases returned their expected result, including the three refusals. It does not change an INCOMPLETE case into PASS. ECDSA keys and signed envelope bytes vary on every execution; source and fixture hashes and expected outcomes are reproducible.

Read the evidence before extending the claim

Recorded local run: actual outcomes, reasons, input/source hashes, runtime versions and limits.
Bundle manifest: exact download bytes. Hashes establish integrity; the manifest is repository-declared, not an independent signer identity.
Canonical source lock and dependency lock: inspect exactly what the runner loads.
Full reproduction instructions: inspect scope and compare a new report with the recorded outcomes.

Freshness is evaluated against the SAMPLE record's fixed assessment time. The run cannot establish today's deployment state. PyPI szl-receipt-dsse==0.3.3 is a separate published distribution; equivalence to this source revision remains UNKNOWN.

Provider operations, model inference, real-world witness execution, energy measurement and independent outside replay were NOT RUN. Production readiness and action authorization are UNKNOWN.

Built with the existing Apache-2.0 canonical library, maintained cryptography and in-toto attestation. DSSE follows its published protocol. These prior contributions retain their attribution.