MCP methods
choiceproof.receipt.beginchoiceproof.receipt.appendOpening the current...
The Execution Evidence interface accepts lifecycle evidence through MCP or loopback HTTP and returns Execution Receipts for attempts, outcomes, reversals, and reconciliations.
The caller defines the action and retains execution, authorization, credentials, private values, routing, settlement, repetition, and reversal. ChoiceProof does not require an action-specific business schema.
At local ingress, caller-defined private values are canonicalized and hashed. The journal stores opaque commitments, lifecycle records, declared source metadata, and signatures.
The signing key may remain in an enterprise KMS, HSM, or signing service. The external-signer helper receives the fixed EIP-712 hash profile rather than the complete Execution Receipt.
begin creates an attempt record. append adds a source-reported lifecycle observation. Neither operation invokes a provider or an external tool.
choiceproof.receipt.beginchoiceproof.receipt.appendBearer-authenticated local routes for begin, append, read, bundle export, and health.
Use an absolute reviewed helper for any KMS, HSM, or signing service. ChoiceProof re-verifies every returned signature.
Public materials define the record format, commitment profile, fixed vectors, and independent verification rules. They do not include the enterprise capture service or its production configuration.
Capture-boundary policy, reconciliation, anomaly controls, enterprise connectors, key operations, deployment, and service operations are maintained as proprietary systems.
The examples use caller-defined JSON. Private values are hashed at local ingress and are not included in an Execution Receipt or Receipt Bundle.
{
"source": {
"runtimeId": "runtime:any",
"agentId": "agent:any",
"invocationId": "invocation-001",
"protocol": "mcp",
"implementation": "external-agent-runtime"
},
"occurredAt": "2026-07-28T00:00:00.000Z",
"traceId": "trace-001",
"action": {
"name": "external_tool_call",
"effectKind": "org.example/declared-effect",
"effectMode": "one_time"
},
"privateInput": {
"callerDefined": "opaque value"
}
}{
"attemptId": "attempt_<begin-result>",
"lifecycle": "outcome",
"sourceEventId": "source-observation-001",
"occurredAt": "2026-07-28T00:00:01.000Z",
"status": "unknown",
"privateResult": {
"callerDefined": "opaque value"
}
}An Execution Receipt is the artifact.receipt object. Its sibling artifact.commitment is the Receipt Commitment, which contains the Execution Receipt hash and signature. A Receipt Bundle packages lifecycle-linked receipts. The verification report is a separate result, not another Execution Receipt.
The JSON examples retain the published v0.1 schema identifiers for wire compatibility.
entries[0].artifact.receipt
Declared intent captured as requested.
entries[1].artifact.receipt
Provider response captured as succeeded.
entries[2].artifact.receipt
Later ledger observation linked to the outcome.
This fixed synthetic refund chain was generated by the Execution Evidence service with a public test-only key. The caller supplied one begin, one outcome, and a later reconciliation. ChoiceProof derived the identifiers, Receipt Commitments, lifecycle links, signatures, Receipt Bundle, and verification report. No real external action occurred.
Receipt Bundle
└── entries[0]
├── record
├── reference
└── artifact
├── receipt ← the Execution Receipt
└── commitment ← Receipt Commitment (hash + signature)The complete Receipt Bundle is long because it also carries records, references, commitments, and signatures. The object named receipt is the Execution Receipt itself.
{
"schemaVersion": "choiceproof.evidenceEvent.v0.1",
"eventId": "evt_3e86ba194a846d121f3fe00bcafe2e356342341f234640acbf3f2428110d6c03",
"eventType": "agent.issue_refund",
"occurredAt": "2026-07-28T00:00:00.000Z",
"capturedAt": "2026-07-28T00:00:10.000Z",
"action": {
"name": "issue_refund",
"phase": "intent",
"status": "requested"
},
"commitments": {
"request": "sha256:ae70abd775de073b5c36c9838c1cdb6409cf637e74ddb2e98e4d5d81cc9cb8d6"
},
"sourceAttestation": {
"level": "self_asserted",
"status": "unverified"
}
}{
"schemaVersion": "choiceproof.receiptEvidenceBundle.v0.1",
"attemptId": "attempt_3c509dded3c3e8f8765168bd9fd7b7126c2083b19ce5569b9e6cb150020f8087",
"entries": [
{
"lifecycle": "attempt",
"status": "requested",
"recordId": "record_2cfedc82962032eb87361719c0ae5ed732e13991d7dc47efdcc989ccd19f484d"
},
{
"lifecycle": "outcome",
"status": "succeeded",
"recordId": "record_ffe09db66a394a35428dfaf2cb5f1819bfb53d983ccbb6cf25b10e7151f69872"
},
{
"lifecycle": "reconciliation",
"status": "succeeded",
"recordId": "record_05aad04e6598773554b3c4301648544703948e971e3b1526345d6f666229010f"
}
]
}{
"schemaVersion": "choiceproof.receiptEvidenceVerificationReport.v0.1",
"ok": true,
"networkUsed": false,
"checks": {
"bundleEnvelopeValid": true,
"bundleAttemptMatches": true,
"artifactIdentitiesMatch": true,
"artifactsValid": true,
"noForbiddenBusinessFields": true
},
"reasonCodes": []
}The Receipt Bundle is about 22 KB because callers do not author or store only the short preview shown here. This sample establishes record integrity, lifecycle links, commitment bindings, and declared-signer signatures for these files. It does not establish that the declared refund was authorized or occurred in an external system.
Offline verification checks record integrity, lifecycle links, commitment bindings, and declared-signer signatures. Authorization, external execution, source identity, completeness, ordering, and factual truth are outside this result.