What Information Is Captured in Archify’s Delivery Receipt for Source Evidence?

Archify’s delivery receipt for source evidence captures the repository URL, exact commit revision, reference count for downstream dependencies, evidence type, and timestamp, creating an immutable, signed JSON document that proves a specific code snapshot was verified.

The tt-a1i/archify repository implements a deterministic evidence-tracking system where delivery receipts serve as cryptographic proof that source code has been verified. Understanding what information Archify captures in a delivery receipt for source evidence is essential for building auditable pipelines and ensuring reproducible builds across agent workflows.

Core Fields in the Archify Delivery Receipt

According to the schema defined in archify/references/delivery-receipt.md and demonstrated in docs/research-repo-evidence-passport-2026-07-23.md, each receipt contains five critical data points that establish provenance and usage scope.

Repository Origin and Revision SHA

The repository field stores the full Git URL, while the revision field records the exact commit SHA or tag. These two fields guarantee that the receipt ties to an immutable snapshot of the code, ensuring any consumer can pinpoint the precise source state without ambiguity.

Reference Count for Downstream Impact

The referenceCount field tracks how many downstream artifacts—such as diagrams, compliance checks, or derivative receipts—depend on this specific source evidence. This integer helps downstream agents understand the impact scope and dependency graph of the evidence.

Evidence Type and Generation Timestamp

Optional but critical metadata includes the type field (e.g., git, zip, tar) clarifying how the source was obtained, and the timestamp field containing an ISO-8601 string marking when Archify generated the receipt.

Delivery Receipt Schema Definition and Contracts

Archify formalizes the receipt structure in specific reference documents that govern how agents consume and validate evidence.

Schema Definition in delivery-receipt.md

The file archify/references/delivery-receipt.md specifies the required and optional fields for the JSON schema, establishing the contract that all receipts must fulfill to be considered valid within the Archify ecosystem.

Integration with Authoring Contracts

As detailed in archify/references/authoring-contract.md, delivery receipts integrate with Archify’s broader authoring contract, defining how agents should consume source evidence and propagate reference counts when creating dependent artifacts.

Generating and Validating Receipts in Practice

The repository provides concrete APIs for creating and inspecting delivery receipts, implemented in the core runtime and validated through comprehensive test suites.

Creating Source Evidence and Receipts

Use the createSourceEvidence function to initialize evidence from a repository, then pass the result to generateReceipt to produce the signed JSON document:

// Generate a delivery receipt for source evidence
import { createSourceEvidence, generateReceipt } from "archify";

const source = await createSourceEvidence({
  repository: "https://github.com/example/project",
  revision: "a1b2c3d4e5f6g7h8i9j0klmnopqrstu",
  type: "git",
});

const receipt = await generateReceipt(source);
console.log(JSON.stringify(receipt, null, 2));

The resulting JSON object contains the repository, revision, referenceCount (initialized to 0), type, and timestamp fields.

Incrementing Reference Counts

When downstream artifacts reuse the evidence, call incrementReference to update the count:

import { incrementReference } from "archify";

const updatedReceipt = await incrementReference(receipt);
console.log(updatedReceipt.referenceCount); // Outputs: 1

Verifying Receipt Integrity

Before consuming evidence, agents should validate the receipt using the verifyReceipt function:

import { verifyReceipt } from "archify";

if (await verifyReceipt(receipt)) {
  console.log("Receipt is valid and can be trusted.");
} else {
  console.error("Receipt verification failed.");
}

Testing and Validation Logic

The file archify/test/workflow-semantic-contract.test.mjs contains the test suite that verifies receipt generation ensures captured fields conform to the schema. These tests validate that referenceCount increments correctly, revision strings match valid SHA patterns, and timestamp fields parse as valid ISO-8601 dates.

Summary

• Archify’s delivery receipt for source evidence captures five core fields: repository URL, revision SHA, referenceCount, type, and timestamp.
• The schema is formally defined in archify/references/delivery-receipt.md and integrated via archify/references/authoring-contract.md.
• Receipts are immutable, signed JSON documents that prove a specific code snapshot was verified without requiring re-cloning.
• The referenceCount field tracks downstream dependencies, enabling impact analysis across agent workflows.
• Validation occurs through verifyReceipt and is enforced by tests in archify/test/workflow-semantic-contract.test.mjs.

Frequently Asked Questions

What is a delivery receipt in Archify?

A delivery receipt in Archify is an immutable, signed JSON document that serves as proof a specific source code snapshot (source evidence) has been successfully verified and recorded. It contains metadata including the repository URL, exact commit SHA, and dependency tracking information.

How does Archify ensure the immutability of source evidence?

Archify ensures immutability by capturing the exact revision SHA or tag in the receipt, linking the document to a specific, unchangeable state of the repository. The receipt itself is signed, preventing tampering with the recorded metadata after generation.

Can I verify a delivery receipt without re-cloning the repository?

Yes. The verifyReceipt function allows consumers to validate the signature and schema compliance of a receipt independently. Because the receipt contains the repository and revision identifiers, verification confirms the evidence provenance without requiring network access to the original Git remote.

What does the referenceCount field indicate?

The referenceCount field indicates how many downstream artifacts, diagrams, or derivative receipts currently depend on this specific source evidence. This integer helps agents and auditors assess the blast radius of changes and track the usage scope of verified code snapshots.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}