Execution receipts

After execution, Sweep issues an ExecutionReceipt: plan id and hash, actor and delegating user, policy version, grant and commercial authorization references, rate-card version, per-object results (actions attempted/completed, Vault object ids and hashes, provider result ids, restorability), measured before/after state per source, bytes preserved/removed/transferred, charges with usage event ids, timestamps and restoration capability.

hash is the SHA-256 of the canonical JSON (sorted keys, no whitespace) of the receipt without hash and signature. signature is an Ed25519 signature over hash, identified by kid.

Verify offline

const jwks = await fetch("https://api.trustysweep.com/.well-known/sweep-receipts.json").then((r) => r.json());
const { valid } = await sweep.receipts.verify(receipt, jwks);

from trustysweep import receipts
receipts.verify(receipt, jwks)  # {"valid": True, "reason": None, "kid": "sweep-receipts-2026-09"}

A receipt must describe the committed plan: same plan id and hash, and no object outside the plan. Keys rotate by adding a new kid; old keys remain published for verification of historical receipts.