What a receipt contains
The receipt for one committed entry, at the altitude a relying party needs: what is in it, what it lets them check, and what it never carries.
A receipt is one committed entry, on its own, with everything a check of that one entry needs. records.receipt fetches one; the history carries one per committed entry; the Shared Record shows each one as the entry detail. This page says what is inside, so a person you hand a receipt to knows what they are holding.
What you receive
- The record's key and the entry's number. Which record, and which entry of it.
- The state before and after. The entry's lifecycle word and number as they were committed, and the ones before it.
- The record type and its fingerprint. The shape the entry was written in, so a reader can confirm they decoded it with the shape you declared.
- The sealed record. The entry as you wrote it: the title, the time, who acted, the fingerprints of the files it names, and whatever else you sent.
- The seal, and the value that lets this one entry be checked. Recomputing the seal from the sealed record with that value reproduces what was committed. It opens this entry and no other.
- Where the entry sits. Its position among the entries committed with it, and what the check needs to confirm it sits there.
One receipt proves one entry. It cannot be used to read or check any other entry, and it carries nothing that would.
What it lets a reader check
With the receipt alone, offline: that the sealed record reproduces the seal. With the receipt and the public source: that the seal is the one committed, at that position, at that time. The Shared Record's entry detail says the result in one sentence, "The sealed record reproduces this seal." or "The sealed record does not reproduce this seal.", and prints the seal, 64 characters, beneath the sealed record.
What it never carries
No file, no storage location, no file name. A file is named only by its fingerprint. No other record of yours, and nothing about your workspace beyond what names the record. No key of yours. The receipt is safe to hand to the person who needs to rely on the entry, and to no one else, because it reveals the sealed record to whoever holds it.
The seal
A committed seal reveals nothing about what is inside, and no one can change it, PacSpace included. Two entries with the same sealed record do not share a seal, because each entry's value is its own; so a seal cannot be used to guess what an entry says by trying likely contents. Kind, actor, and time are sealed with the title.
Receipts and the history file
The history file is every receipt of a record in one file, with the record's count and its own fingerprint, so that a reader can check the whole record at once and keep it. A single receipt is for the case where one entry is what matters: a specific approval, a specific build, a specific message.