Format · ask-orders.capture-receipt.v1

Capture receipt

Proof that these exact bytes were captured by this device at this time, by its own clock. The device's key is named on-chain by its owner. One format and one verifier are shared by Rootz Receipts and Archive Free.

What it proves, and what it does not

Proves: the bytes are unaltered, and they were recorded in a log signed by a device key that its owner's on-chain root names.
Does not prove: that the content is true; that the time is right (it is the device's own clock); or that the key sits in secure hardware (that is stated by the device, not attested).

The objects

The conventions are those of every Rootz receipt:

every object has a versioned kind;
canonical bytes are RFC 8785 (JCS);
digests are "sha256:" + base64url;
signatures sit outside the signed body;
times are RFC 3339 UTC.

A device's archive is an append-only RFC 9162 log, and each captured file version is one entry in it:

{ "type": "capture",
  "capture_scheme": "rootz-archive-vault/1",
  "source": "claude-code",
  "capture_kind": "transcript",
  "body": { "sha256": "sha256:…", "bytes": 257 },
  "base": { "sha256": "sha256:…", "bytes": 129 },
  "private": { "path": "sha256:…", "host": "sha256:…", "mtime_ms": "sha256:…" } }

body commits to the full raw bytes of this version. base names the earlier full version of an appended file, or is null.
private holds salted commitments: sha256(salt ‖ JCS(value)), with a fresh 16-byte salt per field per record. The sharer chooses which fields to open.
The entry's at is the capture time, by the device clock.

The device signs checkpoints of its log with a P-256 key: suite rootz.sign-mcp.v1, binding secure-enclave. Each checkpoint carries a signed route saying where its records are verified and resolved.

The receipt is:

{ "kind": "ask-orders.capture-receipt.v1",
  "subject": <the capture entry>, "inclusion": <its proof>, "checkpoint": <the device-signed tree head>,
  "authority": <hops from the owner's root to the device key>, "keys": <the device public key, a copy>,
  "openings": { "path": { "value": "…", "salt": "…" } } }

The device key is trusted only by name. The last authority hop is an on-chain line from the owner's root:

rootz-receipts:authorize v1 … role=device kid=<thumbprint> jkt-p256=<thumbprint> …

A key the root does not name is refused, wherever it was served from.

The five lines a verifier reports

Authorized by	The device key is named by the owner's root (`role=device`) and valid at the checkpoint time.
Specification	The capture is well formed, and every opened private field matches its commitment. An unopened field is reported as withheld.
Materials	For an appended version, the bytes begin with the earlier version it names.
Process	Always asserted: the capture time is the device clock, and the key binding is stated, not attested.
Integrity	The entry is in the signed log, the checkpoint verifies with the named key, and the supplied bytes match.

Files

Schemas:
- capture-receipt
- leaf (the Capture event)
- checkpoint
- common
- origin-receipt (authority evidence)
Test vectors: capture receipts (4 records, 6 negatives, published test keys) and the P-256 device signer.
Check one now: verify a receipt in your browser.
Make them: Archive Free, the free Claude Code plugin.