What this page is: A definition of a receipt as a technical object in protocol design. What it explains: What a receipt contains, what properties it has, and why it is the fundamental unit of proof in OIP. Why read it: To understand how to prove that an action happened — not with a log entry or a status code, but with a self-contained, verifiable, immutable record.
What a Receipt Is
In protocol design, a receipt is a proof that an action was performed. It is not a log entry (a chronological record of events). It is not an audit trail (a history of who accessed what). It is a self-contained, verifiable, immutable record of a single invocation — one specific call to one specific function with one specific result.
A receipt is created at the moment an invocation completes. It cannot be changed afterward. If the invocation was wrong, a new receipt is created to correct it. The original receipt remains.
Why It Matters
In most systems, "proof that something happened" means a log line in a database, a 200 HTTP status code, or an entry in an audit trail. These are not proof. A log line can be deleted. A status code is ephemeral — it exists only in the response and is not stored. An audit trail tracks access, not action.
A receipt fixes this. It is a cryptographic object: it has hashes, signatures, and unique identifiers. It can be verified by anyone with access to the confirm URL. It can be replayed (run again to check the result). It can be repaired (superseded by a corrected invocation, with both receipts linked). The receipt is the only object that proves an action occurred. Everything else is a signal, a record, or a claim — not proof.
The Key Idea
The central concept is proof through immutability and linkage. A receipt proves an action happened because:
It was created at the moment of the action (it is contemporaneous).
It contains hashes of the input and output (tampering is detectable).
It is stored immutably (it cannot be altered after creation).
It is linked to related receipts (parent invocations, repairs, replays form a chain).
Errors are not corrected by editing. They are corrected by creating a new receipt that references the old one. The history of corrections is itself a provable chain.
What a Receipt Contains
A receipt has four sections:
Identity:
invocation_id — a unique identifier for this specific invocation (UUID, never reused).
timestamp — when the invocation completed.
actor — who invoked the action (a principal identifier).
credential_scope — what authority the actor was exercising (which credentials they presented).
Object:
object_key — what was invoked (the function or operation).
object_version — which version of the function was used.
input_hash — the cryptographic hash of the input parameters.
input_body — the actual input parameters (optional if the hash is sufficient).
Result:
runner — what executed the invocation (the compute environment or service).
status — the outcome: success or failure.
output_hash — the cryptographic hash of the output.
artifact_urls — links to any files produced by the invocation.
Lineage:
error — if the status is failure, the error details.
ledger_url — the canonical location where this receipt is stored.
confirm_url — a public URL where anyone can verify this receipt exists.
replay_url — a URL that reruns the same invocation, producing a new receipt.
repair_url — a URL to create a corrected invocation if this one failed.
parent_invocation_id — if this invocation was delegated from another, the parent's ID.
repair_of_invocation_id — if this receipt corrects a failed one, the failed receipt's ID.
Properties of a Receipt
Immutable: Once created, a receipt is never changed. If an invocation produced the wrong result, a repair receipt is created. The original receipt remains, linked to the repair via repair_of_invocation_id. This preserves a complete, auditable history of what happened and what was done about it.
Verifiable: Anyone can confirm a receipt exists by checking its confirm_url. No secret key, no special access, no database query is required. Verification is a public operation.
Replayable: The same invocation can be run again from the receipt. The replay_url reruns the same object_key with the same input_body. The new receipt is linked to the original via parent_invocation_id. This lets you check whether the same inputs produce the same outputs.
Repairable: A failed invocation is not deleted or edited. A new invocation is created with a link back to the failed receipt via repair_of_invocation_id. The failed receipt's repair_url points forward to the correction. The linkage is bidirectional.
How It Connects to Other Ideas
Blockchain transactions: A blockchain transaction is a proof that a transfer occurred. Like a receipt, it is immutable, verifiable, and linked (to previous blocks). Unlike a receipt, a blockchain transaction is typically public, permanent, and does not have a built-in repair mechanism. Receipts are more flexible: they can be private, scoped to a specific ledger, and explicitly repairable.
Merkle trees: A collection of receipts can be organized into a Merkle tree. The root hash of the tree commits to all receipts. A single receipt can be proven to be in the tree with a Merkle proof — the receipt plus a logarithmic number of sibling hashes. This is how BitTorrent verifies file pieces and how OIP can prove receipt inclusion without revealing the whole ledger.
Event sourcing: In event-sourced systems, state is derived from a log of events. A receipt is similar to an event, but it is self-proving (hashes, confirm URLs) and explicitly linked to related events (parent, repair, replay). Event sourcing typically does not include cryptographic verification or public confirmation.
OIP's §SELF block: The §SELF block is a form of receipt — it is a self-contained description of an article that can be verified against the article's content. The conformance test suite generates receipts (pass/fail records with hashes of expected vs. actual output). The voxel graph links receipts into a dependency structure.
{
"schema":"https://miscsubjects.com/schemas/jarticle.json",
"status":"published",
"slug":"what-is-receipt",
"title":"What Is a Receipt",
"kind":"standard",
"summary":"<!-- hierarchy:nav -- Path: OIP(https://miscsubjects.com/a/oip) › Thinker Reference(https://miscsubjects.com/a/oip-thinker-reference) › Protocol Concepts(https://miscsubjects.com/a/oip-protocol-concepts) › What Is a Receipt Shelf: Protocol",
"created":"2026-07-15T06:24:49.992Z",
"body": [
"<!-- hierarchy:nav -->\n> **Path:** [OIP](https://miscsubjects.com/a/oip) › [Thinker Reference](https://miscsubjects.com/a/oip-thinker-reference) › [Protocol Concepts](https://miscsubjects.com/a/oip-protocol-concepts) › **What Is a Receipt**\n>\n> **Shelf:** Protocol Concepts · **Traversal:** self-explaining · hierarchical · voxel-ready\n> **Machine root:** [OIP tree](https://miscsubjects.com/api/dispatch?map=1&format=markdown) · [Registry](https://miscsubjects.com/api/dispatch?registry=1)\n\n# What Is a Receipt\n\n## §SELF — what-is-receipt\n\n**What this page is:** A definition of a receipt as a technical object in protocol design.\n**What it explains:** What a receipt contains, what properties it has, and why it is the fundamental unit of proof in OIP.\n**Why read it:** To understand how to prove that an action happened — not with a log entry or a status code, but with a self-contained, verifiable, immutable record.\n\n### What a Receipt Is\n\nIn protocol design, a receipt is a proof that an action was performed. It is not a log entry (a chronological record of events). It is not an audit trail (a history of who accessed what). It is a self-contained, verifiable, immutable record of a single invocation — one specific call to one specific function with one specific result.\n\nA receipt is created at the moment an invocation completes. It cannot be changed afterward. If the invocation was wrong, a new receipt is created to correct it. The original receipt remains.\n\n### Why It Matters\n\nIn most systems, \"proof that something happened\" means a log line in a database, a 200 HTTP status code, or an entry in an audit trail. These are not proof. A log line can be deleted. A status code is ephemeral — it exists only in the response and is not stored. An audit trail tracks access, not action.\n\nA receipt fixes this. It is a cryptographic object: it has hashes, signatures, and unique identifiers. It can be verified by anyone with access to the confirm URL. It can be replayed (run again to check the result). It can be repaired (superseded by a corrected invocation, with both receipts linked). The receipt is the only object that proves an action occurred. Everything else is a signal, a record, or a claim — not proof.\n\n### The Key Idea\n\nThe central concept is **proof through immutability and linkage.** A receipt proves an action happened because:\n\n1. It was created at the moment of the action (it is contemporaneous).\n2. It contains hashes of the input and output (tampering is detectable).\n3. It is stored immutably (it cannot be altered after creation).\n4. It is linked to related receipts (parent invocations, repairs, replays form a chain).\n\nErrors are not corrected by editing. They are corrected by creating a new receipt that references the old one. The history of corrections is itself a provable chain.\n\n### What a Receipt Contains\n\nA receipt has four sections:\n\n**Identity:**\n- `invocation_id` — a unique identifier for this specific invocation (UUID, never reused).\n- `timestamp` — when the invocation completed.\n- `actor` — who invoked the action (a principal identifier).\n- `credential_scope` — what authority the actor was exercising (which credentials they presented).\n\n**Object:**\n- `object_key` — what was invoked (the function or operation).\n- `object_version` — which version of the function was used.\n- `input_hash` — the cryptographic hash of the input parameters.\n- `input_body` — the actual input parameters (optional if the hash is sufficient).\n\n**Result:**\n- `runner` — what executed the invocation (the compute environment or service).\n- `status` — the outcome: `success` or `failure`.\n- `output_hash` — the cryptographic hash of the output.\n- `artifact_urls` — links to any files produced by the invocation.\n\n**Lineage:**\n- `error` — if the status is `failure`, the error details.\n- `ledger_url` — the canonical location where this receipt is stored.\n- `confirm_url` — a public URL where anyone can verify this receipt exists.\n- `replay_url` — a URL that reruns the same invocation, producing a new receipt.\n- `repair_url` — a URL to create a corrected invocation if this one failed.\n- `parent_invocation_id` — if this invocation was delegated from another, the parent's ID.\n- `repair_of_invocation_id` — if this receipt corrects a failed one, the failed receipt's ID.\n\n### Properties of a Receipt\n\n**Immutable:** Once created, a receipt is never changed. If an invocation produced the wrong result, a repair receipt is created. The original receipt remains, linked to the repair via `repair_of_invocation_id`. This preserves a complete, auditable history of what happened and what was done about it.\n\n**Verifiable:** Anyone can confirm a receipt exists by checking its `confirm_url`. No secret key, no special access, no database query is required. Verification is a public operation.\n\n**Replayable:** The same invocation can be run again from the receipt. The `replay_url` reruns the same `object_key` with the same `input_body`. The new receipt is linked to the original via `parent_invocation_id`. This lets you check whether the same inputs produce the same outputs.\n\n**Repairable:** A failed invocation is not deleted or edited. A new invocation is created with a link back to the failed receipt via `repair_of_invocation_id`. The failed receipt's `repair_url` points forward to the correction. The linkage is bidirectional.\n\n### How It Connects to Other Ideas\n\n- **Blockchain transactions:** A blockchain transaction is a proof that a transfer occurred. Like a receipt, it is immutable, verifiable, and linked (to previous blocks). Unlike a receipt, a blockchain transaction is typically public, permanent, and does not have a built-in repair mechanism. Receipts are more flexible: they can be private, scoped to a specific ledger, and explicitly repairable.\n- **Merkle trees:** A collection of receipts can be organized into a Merkle tree. The root hash of the tree commits to all receipts. A single receipt can be proven to be in the tree with a Merkle proof — the receipt plus a logarithmic number of sibling hashes. This is how BitTorrent verifies file pieces and how OIP can prove receipt inclusion without revealing the whole ledger.\n- **Event sourcing:** In event-sourced systems, state is derived from a log of events. A receipt is similar to an event, but it is self-proving (hashes, confirm URLs) and explicitly linked to related events (parent, repair, replay). Event sourcing typically does not include cryptographic verification or public confirmation.\n- **OIP's §SELF block:** The §SELF block is a form of receipt — it is a self-contained description of an article that can be verified against the article's content. The conformance test suite generates receipts (pass/fail records with hashes of expected vs. actual output). The voxel graph links receipts into a dependency structure.\n\n### Sources\n\n- OIP Protocol Specification: Receipt Format (v1).\n- OIP Protocol Specification: Invocation Lifecycle (v1).\n- OIP Protocol Specification: Ledger and Confirmation (v1).\n\n---\n\n## Up the tree\n\n- [OIP root](https://miscsubjects.com/a/oip) — protocol root, zero-context entry\n- [Thinker Reference hub](https://miscsubjects.com/a/oip-thinker-reference) — full hierarchy map\n- [Protocol Concepts shelf](https://miscsubjects.com/a/oip-protocol-concepts) — siblings on this shelf\n- [Voxel graph article](https://miscsubjects.com/a/what-is-voxel-graph) — how pages link as voxels\n- [Self-describing protocol](https://miscsubjects.com/a/what-is-self-describing-protocol)\n\n## Related on this shelf\n\n- [What Is Autopoiesis](https://miscsubjects.com/a/what-is-autopoiesis)\n- [What Is Capability-Based Security](https://miscsubjects.com/a/what-is-capability-security)\n- [What Is a Capability Token](https://miscsubjects.com/a/what-is-capability-token)\n- [What Is a Confused Deputy](https://miscsubjects.com/a/what-is-confused-deputy)\n- [What Is Context as Cursor](https://miscsubjects.com/a/what-is-context-as-cursor)\n- [What Is a Convergence Catalogue](https://miscsubjects.com/a/what-is-convergence-catalogue)\n- [What Is a Falsification Surface](https://miscsubjects.com/a/what-is-falsification-surface)\n- [What Is HATEOAS](https://miscsubjects.com/a/what-is-hateoas)\n\n## Machine surfaces\n\n- Public page: `https://miscsubjects.com/a/what-is-receipt`\n- JSON article: `https://miscsubjects.com/api/articles/what-is-receipt`\n- OIP ask: `https://miscsubjects.com/api/dispatch?ask=What%20Is%20a%20Receipt`"
],
"facts": {
"converted_from":"markdown",
"original_updated":"2026-07-15T04:21:02.436Z",
"register":"standard",
"category":null
},
"type":"article",
"updated":"2026-10-08T11:34:17.871Z",
"version":1,
"hash":"76e3466fc0df98867b4d21eda49f88624b56e31a98fd77a4dd5f174491cee6d4",
"styling": {
"scope":"shared",
"how":"no value on the page is set by hand: each comes from this theme, and each theme value becomes the CSS variable named beside it. PATCH https://miscsubjects.com/api/jarticles/theme changes them.",
"widget_style": {
"what":"every widget may carry style: {…}; these are the only keys it reads",
"rotate":"degrees, a number",
"offset_x":"pixels, a number",
"offset_y":"pixels, a number",
"pulse":"true to pulse"
},
"theme": {
"color": {
"page_bg":"#f5f5f7",
"sheet_bg":"#ffffff",
"ink":"#1d1d1f",
"soft":"#424245",
"muted":"#6e6e73",
"dim":"#86868b",
"line":"#d2d2d7",
"accent":"#0071e3",
"accent_soft":"rgba(0,113,227,0.08)",
"link":"#0066cc",
"selection":"rgba(0,113,227,0.18)",
"widget_bg":"#f5f5f7",
"widget_border":"#d2d2d7",
"card_bg":"#ffffff",
"code_bg":"#f5f5f7",
"json_bg":"#161b19",
"json_ink":"#e6e1d4",
"json_key":"#7fd3c3",
"json_string":"#e9c46a",
"json_number":"#f4a261",
"json_bool":"#c792ea",
"json_null":"#928d7e",
"json_punct":"#6b6759",
"json_bar":"#0e1512",
"kind_badge_bg":"#0e6e60",
"kind_badge_ink":"#ffffff"
},
"color_dark": {
"page_bg":"#000000",
"sheet_bg":"#1d1d1f",
"ink":"#f5f5f7",
"soft":"#d2d2d7",
"muted":"#a1a1a6",
"dim":"#86868b",
"line":"#424245",
"accent":"#2997ff",
"accent_soft":"rgba(41,151,255,0.12)",
"link":"#2997ff",
"selection":"rgba(41,151,255,0.25)",
"widget_bg":"#2c2c2e",
"widget_border":"#424245",
"card_bg":"#1d1d1f",
"code_bg":"#2c2c2e",
"json_bg":"#0a0d0c",
"json_ink":"#e6e1d4",
"json_key":"#7fd3c3",
"json_string":"#e9c46a",
"json_number":"#f4a261",
"json_bool":"#c792ea",
"json_null":"#757062",
"json_punct":"#5d665f",
"json_bar":"#060807",
"kind_badge_bg":"#4fc1ab",
"kind_badge_ink":"#0b0f0d"
},
"font": {
"display":"-apple-system,BlinkMacSystemFont,\"SF Pro Display\",\"SF Pro Text\",\"Helvetica Neue\",Helvetica,Arial,sans-serif",
"body":"-apple-system,BlinkMacSystemFont,\"SF Pro Display\",\"SF Pro Text\",\"Helvetica Neue\",Helvetica,Arial,sans-serif",
"mono":"ui-monospace,SFMono-Regular,\"SF Mono\",Menlo,Consolas,monospace",
"google_fonts":""
},
"size": {
"body":"17px",
"small":"17px",
"eye":"17px",
"lead":"17px",
"h1":"52px",
"h2":"34px",
"h3":"22px",
"byline":"17px",
"h1_measure":"none",
"code":"17px",
"json":"17px",
"widget_title":"17px"
},
"leading": {
"body":"1.7",
"head":"1.18",
"lead":"1.5",
"json":"1.6"
},
"weight": {
"display":"700",
"head":"700",
"body":"400",
"strong":"700",
"eye":"700"
},
"tracking": {
"eye":"0.14em",
"display":"-0.03em",
"body":"-0.006em",
"badge":"0.08em"
},
"layout": {
"sheet_width":"1000px",
"text_width":"880px",
"gutter":"16px",
"sheet_padding":"56px 64px 64px",
"sheet_padding_mobile":"24px 18px 40px",
"sheet_margin":"28px auto 72px",
"block_gap":"1.15em",
"widget_gap":"28px",
"grid_gap":"14px"
},
"border": {
"sheet":"0px solid",
"sheet_radius":"30px",
"widget":"1px solid",
"widget_radius":"24px",
"card_radius":"24px",
"badge_radius":"999px",
"rule":"1px solid",
"code_radius":"18px",
"accent_bar":"3px"
},
"shadow": {
"sheet":"0 1px 1px rgba(0,0,0,.02),0 6px 26px rgba(0,0,0,.05)",
"widget":"none",
"card_hover":"0 10px 28px -16px rgba(28,27,23,0.35)"
},
"motion": {
"hover":"160ms ease"
}
}
},
"page":"https://miscsubjects.com/a/what-is-receipt",
"json":"https://miscsubjects.com/a/what-is-receipt.json",
"markdown":"https://miscsubjects.com/a/what-is-receipt.md",
"theme":"https://miscsubjects.com/article-theme.json",
"calls": [
{
"what":"this article as a page (no key)",
"method":"GET",
"url":"https://miscsubjects.com/a/what-is-receipt",
"headers": {}
},
{
"what":"this article as its object (no key)",
"method":"GET",
"url":"https://miscsubjects.com/a/what-is-receipt.json",
"headers": {}
},
{
"what":"this article as Markdown (no key)",
"method":"GET",
"url":"https://miscsubjects.com/a/what-is-receipt.md",
"headers": {}
},
{
"what":"the object with its hash, drafts too",
"method":"GET",
"url":"https://miscsubjects.com/api/jarticles/what-is-receipt",
"headers": {
"x-sheets-key":"$(cat /Users/cyrusmassoumi/.misc-sheets-key)"
}
},
{
"what":"one piece and that piece’s hash",
"method":"GET",
"url":"https://miscsubjects.com/api/jarticles/what-is-receipt/at?path=facts",
"headers": {
"x-sheets-key":"$(cat /Users/cyrusmassoumi/.misc-sheets-key)"
}
},
{
"what":"grep: every key or value that matches, with the path to change it",
"method":"GET",
"url":"https://miscsubjects.com/api/jarticles/what-is-receipt/grep?q=owner",
"headers": {
"x-sheets-key":"$(cat /Users/cyrusmassoumi/.misc-sheets-key)"
}
},
{
"what":"change pieces (set, merge, delete, append, insert, move); if-match is the hash",
"method":"PATCH",
"url":"https://miscsubjects.com/api/jarticles/what-is-receipt",
"headers": {
"x-sheets-key":"$(cat /Users/cyrusmassoumi/.misc-sheets-key)",
"content-type":"application/json",
"if-match":"<hash from the read>"
},
"body": {
"ops": [
{
"op":"set",
"path":"facts.example",
"value":1
}
]
}
},
{
"what":"replace the whole object",
"method":"PUT",
"url":"https://miscsubjects.com/api/jarticles/what-is-receipt",
"headers": {
"x-sheets-key":"$(cat /Users/cyrusmassoumi/.misc-sheets-key)",
"content-type":"application/json",
"if-match":"<hash>"
},
"body": {
"slug":"what-is-receipt",
"title":"…"
}
},
{
"what":"fetch every source, hash what came back and check the quote is in it",
"method":"POST",
"url":"https://miscsubjects.com/api/jarticles/what-is-receipt/verify",
"headers": {
"x-sheets-key":"$(cat /Users/cyrusmassoumi/.misc-sheets-key)",
"content-type":"application/json"
},
"body": {}
},
{
"what":"an Obsidian-style command",
"method":"POST",
"url":"https://miscsubjects.com/api/jarticles/cli",
"headers": {
"x-sheets-key":"$(cat /Users/cyrusmassoumi/.misc-sheets-key)",
"content-type":"application/json"
},
"body": {
"command":"backlinks",
"file":"what-is-receipt"
}
}
]
}