# What Information Is Captured in Archify’s Delivery Receipt for Source Evidence?

> Discover what info Archify's delivery receipt captures for source evidence, including URL, commit revision, dependency count, type, and timestamp for immutable proof of code verification.

- Repository: [tt-a1i/archify](https://github.com/tt-a1i/archify)
- Tags: deep-dive
- Published: 2026-09-09

---

**Archify’s delivery receipt for source evidence captures the repository URL, exact commit revision, reference count for downstream dependencies, evidence type, and timestamp, creating an immutable, signed JSON document that proves a specific code snapshot was verified.**

The `tt-a1i/archify` repository implements a deterministic evidence-tracking system where delivery receipts serve as cryptographic proof that source code has been verified. Understanding what information Archify captures in a delivery receipt for source evidence is essential for building auditable pipelines and ensuring reproducible builds across agent workflows.

## Core Fields in the Archify Delivery Receipt

According to the schema defined in [`archify/references/delivery-receipt.md`](https://github.com/tt-a1i/archify/blob/main/archify/references/delivery-receipt.md) and demonstrated in [`docs/research-repo-evidence-passport-2026-07-23.md`](https://github.com/tt-a1i/archify/blob/main/docs/research-repo-evidence-passport-2026-07-23.md), each receipt contains five critical data points that establish provenance and usage scope.

### Repository Origin and Revision SHA

The **repository** field stores the full Git URL, while the **revision** field records the exact commit SHA or tag. These two fields guarantee that the receipt ties to an immutable snapshot of the code, ensuring any consumer can pinpoint the precise source state without ambiguity.

### Reference Count for Downstream Impact

The **referenceCount** field tracks how many downstream artifacts—such as diagrams, compliance checks, or derivative receipts—depend on this specific source evidence. This integer helps downstream agents understand the impact scope and dependency graph of the evidence.

### Evidence Type and Generation Timestamp

Optional but critical metadata includes the **type** field (e.g., `git`, `zip`, `tar`) clarifying how the source was obtained, and the **timestamp** field containing an ISO-8601 string marking when Archify generated the receipt.

## Delivery Receipt Schema Definition and Contracts

Archify formalizes the receipt structure in specific reference documents that govern how agents consume and validate evidence.

### Schema Definition in delivery-receipt.md

The file [`archify/references/delivery-receipt.md`](https://github.com/tt-a1i/archify/blob/main/archify/references/delivery-receipt.md) specifies the required and optional fields for the JSON schema, establishing the contract that all receipts must fulfill to be considered valid within the Archify ecosystem.

### Integration with Authoring Contracts

As detailed in [`archify/references/authoring-contract.md`](https://github.com/tt-a1i/archify/blob/main/archify/references/authoring-contract.md), delivery receipts integrate with Archify’s broader authoring contract, defining how agents should consume source evidence and propagate reference counts when creating dependent artifacts.

## Generating and Validating Receipts in Practice

The repository provides concrete APIs for creating and inspecting delivery receipts, implemented in the core runtime and validated through comprehensive test suites.

### Creating Source Evidence and Receipts

Use the `createSourceEvidence` function to initialize evidence from a repository, then pass the result to `generateReceipt` to produce the signed JSON document:

```javascript
// Generate a delivery receipt for source evidence
import { createSourceEvidence, generateReceipt } from "archify";

const source = await createSourceEvidence({
  repository: "https://github.com/example/project",
  revision: "a1b2c3d4e5f6g7h8i9j0klmnopqrstu",
  type: "git",
});

const receipt = await generateReceipt(source);
console.log(JSON.stringify(receipt, null, 2));

```

The resulting JSON object contains the **repository**, **revision**, **referenceCount** (initialized to `0`), **type**, and **timestamp** fields.

### Incrementing Reference Counts

When downstream artifacts reuse the evidence, call `incrementReference` to update the count:

```javascript
import { incrementReference } from "archify";

const updatedReceipt = await incrementReference(receipt);
console.log(updatedReceipt.referenceCount); // Outputs: 1

```

### Verifying Receipt Integrity

Before consuming evidence, agents should validate the receipt using the `verifyReceipt` function:

```javascript
import { verifyReceipt } from "archify";

if (await verifyReceipt(receipt)) {
  console.log("Receipt is valid and can be trusted.");
} else {
  console.error("Receipt verification failed.");
}

```

## Testing and Validation Logic

The file `archify/test/workflow-semantic-contract.test.mjs` contains the test suite that verifies receipt generation ensures captured fields conform to the schema. These tests validate that **referenceCount** increments correctly, **revision** strings match valid SHA patterns, and **timestamp** fields parse as valid ISO-8601 dates.

## Summary

- Archify’s delivery receipt for source evidence captures five core fields: **repository** URL, **revision** SHA, **referenceCount**, **type**, and **timestamp**.
- The schema is formally defined in [`archify/references/delivery-receipt.md`](https://github.com/tt-a1i/archify/blob/main/archify/references/delivery-receipt.md) and integrated via [`archify/references/authoring-contract.md`](https://github.com/tt-a1i/archify/blob/main/archify/references/authoring-contract.md).
- Receipts are immutable, signed JSON documents that prove a specific code snapshot was verified without requiring re-cloning.
- The **referenceCount** field tracks downstream dependencies, enabling impact analysis across agent workflows.
- Validation occurs through `verifyReceipt` and is enforced by tests in `archify/test/workflow-semantic-contract.test.mjs`.

## Frequently Asked Questions

### What is a delivery receipt in Archify?

A delivery receipt in Archify is an immutable, signed JSON document that serves as proof a specific source code snapshot (source evidence) has been successfully verified and recorded. It contains metadata including the repository URL, exact commit SHA, and dependency tracking information.

### How does Archify ensure the immutability of source evidence?

Archify ensures immutability by capturing the exact **revision** SHA or tag in the receipt, linking the document to a specific, unchangeable state of the repository. The receipt itself is signed, preventing tampering with the recorded metadata after generation.

### Can I verify a delivery receipt without re-cloning the repository?

Yes. The `verifyReceipt` function allows consumers to validate the signature and schema compliance of a receipt independently. Because the receipt contains the **repository** and **revision** identifiers, verification confirms the evidence provenance without requiring network access to the original Git remote.

### What does the referenceCount field indicate?

The **referenceCount** field indicates how many downstream artifacts, diagrams, or derivative receipts currently depend on this specific source evidence. This integer helps agents and auditors assess the blast radius of changes and track the usage scope of verified code snapshots.