Receipt fields
Per-field semantics: what each field proves, what it does not, and when it populates. The receipt ships on every call. Fields are grouped by customer importance; a field populates only when the stage behind it ran, and a group with no set members does not serialize. Absence is honest telemetry: no placeholders, no "not yet available" strings. The subsequence check is client-verifiable: run the same two-pointer check on the input and output you hold.headline
Field Populated when Proves Does not prove headline.squeeze_modealways which mode executed that a lower rung was not silently used (there is no silent fallback) headline.ratioalways the realized compression: output chars / input chars that the output is faithful - check qualityintegrity
Field Populated when Proves Does not prove integrity.raw_sha256always the exact input bytes hashed anything about the output integrity.output_sha256always the exact output bytes hashed anything about the input integrity.output_is_subsequenceall three shipped modes the output is obtainable from the input by deleting bytes only (false when a transform inserted bytes, e.g. the JSON reform) that the surviving bytes are the right bytes - subset-ness is not fidelity counts
Field Populated when Proves Does not prove counts.kept_span_counttoken pruning ran how many distinct survivor runs the pruner kept where the spans are (coordinates are not disclosed) counts.l2_skippedtoken pruning was skipped why: the JSON reform was the compression, so target_ratio was unreachableanything when absent counts.pins_protectedtoken pruning ran per-class count of protected surfaces (NUMERIC, NEGATION, NAMED_ENTITY, REGISTER, TEMPORAL, LITERAL, IDENTIFIER) kept whole that every fact you care about was pinned counts.windows_totalthe NLI stage ran the full-coverage window count of the entailment check the outcome per window counts.exact_matchesthe NLI stage ran how many windows were verbatim recoverable, no model call needed the rest of the windows counts.windows_below_thresholdthe NLI stage ran the blast radius: evaluated windows scoring below the acceptance threshold that a window above threshold is semantically sufficient for your task quality
Field Populated when Proves Does not prove quality.fidelity_scorethe NLI stage ran evidence-retention posterior, weighted mean over windows the worst case - read min_window_posterior for gatingquality.min_window_posteriorthe NLI stage ran the worst evaluated window: the gate field coverage - check the coverage fields quality.relaxed_ratiothe auto-relax loop triggered the first-attempt (strictest) ratio the fidelity gate rejected anything when absent quality.relax_stepsthe auto-relax loop triggered how many retries beyond the first attempt anything when absent quality.coverage_fractionthe NLI stage ran the fraction of the window check actually evaluated (below 1.0 means sampled) that unsampled windows were fine debug
Field Populated when Proves Does not prove debug.model_registryany model ran which models executed (names and versions) their internal quality Signature envelope
key_id and receipt_signature (Ed25519 hex) ship last, when a signing key is configured. The signature covers the canonical (recursively key-sorted) JSON of the receipt excluding the two envelope fields. Verify it end to end.