Receipts

Receipts, not status updates.

Every unit of work produces a test receipt — per-criterion verdicts with falsifiable evidence and verification commands you can run yourself. Not a green check. A document you can open, and disprove.

89 receipts and counting
— all minted from real construction, not written for the brochure.

See one, annotated Read the schema

§ 01 The anatomy, annotated 30.44° N

One receipt, taken apart.

This is a real receipt from this factory's own construction — T-125, eleven of eleven criteria met. Every part earns its place. The numbered notes in the margin point at each one.

The header

Receipt id, the story it verifies, the date, and the exact branch and commit. A receipt is pinned to one point in history — you can check it out.

Acceptance criteria

One row per claim. Each verdict points at a file and line, a named test, and how many assertions ran. Not "done" — a list you can walk.

Surprises

Institutional memory — what the build taught us that the plan didn't know. Even "no surprises" is worth saying; the silence is a claim too.

TEST RECEIPT T-1252026-06-30

@oasis/canvas-host — no mission-control coupling

story S-126plan P-126arc AR-025 branch feat/canvas-hostsha 86682d7

Verified · 11/11

Acceptance criteria

Criterion	Verdict	Evidence
Package builds standalonetestbuilds with no workspace back-refs · 2 assertions	✓ PASS	canvas-host.build.test.ts:19
No mission-control coupling remainsgit grep returns no output · 0 hits	✓ PASS	packages/canvas-host/src
Artifacts serve from a separate origintestserves off ofusercontent.com · 4 assertions	✓ PASS	render-origin.test.ts:64
Sealed CSP on every responsetestsets default-src 'none' · 7 assertions	✓ PASS	csp.test.ts:31
Sandbox omits allow-same-origintestiframe drops same-origin · 3 assertions	✓ PASS	sandbox.test.ts:22
+ 6 more criteria · all PASS — loopback MC regression, headers, egress, types, docs, lint

Run these yourself

$ pnpm --filter @oasis/canvas-host build
$ git grep -n mission-control packages/canvas-host/src   # expect: no output
$ pnpm --filter @oasis/canvas-host test

Surprises

render-origin still pulled a mission-control logger transitively through @oasis/shared — cut the import to keep canvas-host egress-free. Caught here, fixed in-story.
ofusercontent.com needs its own Vercel project so a bad artifact never shares the app's registrable domain — logged as a follow-up, out of this story's scope.

verified by verifier-agent gated by jmcmunn 11 / 11 criteria met

The verdict

Eleven of eleven — not a blanket "done". A count you can reconcile against the rows below. Ten of eleven would say so, in the same place.

The reproduction

The exact commands. Run them; get the same result. The receipt earns trust by being falsifiable — not by being shown to you in a nice font.

Attribution

Who verified, who gated. An agent verifies; a human accepts. Both are on the record, by name, against this commit.

§ 02 The stream 31.20° N

Not one receipt. A ledger of them.

Different work, same shape. Schema migrations, auth, UI, tooling — each unit of work leaves the same falsifiable record. One below is a Partial, on purpose: a story that shipped what it could and said what it didn't.

T-124Multi-vault registry migration Pass

story S-124arc AR-024schema

Pass Registry table added, back-filled, and reversible.0016_multi_vault.sql· up+down round-trips· 5 assertions
Pass Existing single-vault rows migrate untouched.registry.migrate.test.ts:41· 4 assertions

6/6 met /receipts/T-124

T-093OAuth token carries role bitmap Pass

story S-093arc AR-022auth

Pass Roles & projects read off the JWT — no DB on the hot path.token.test.ts:88· claims decode· 6 assertions
Pass Read-only grant is write-gated at the resource server.write-gate.test.ts:29· 4 assertions

8/8 met /receipts/T-093

T-118Planner-edition bundle view Partial

story S-118arc AR-026ui

Pass Bundle renders the front-half intent → ideation chain.bundle-view.spec.ts:52· 5 assertions
Skipped Mobile breakpoint for the bundle view.deferred to S-134 — out of this story's scope

10/11 met· 1 deferred /receipts/T-118

T-131build-planner allowlist target Pass

story S-131arc AR-026plugin build

Pass Emits dist/planner only from the allowlist.build-planner.mjs:41· 6 assertions
Pass Non-allowlisted targets are refused, not dropped.build-planner.test.mjs:70· 3 assertions

3/3 met /receipts/T-131

T-088/mcp resource server verifies JWT Pass

story S-088arc AR-022backend

Pass Bearer tokens verified via jose, three-way branch.mcp.verify.test.ts:47· 9 assertions
Pass Expired / wrong-audience tokens rejected (deny by default).mcp.verify.test.ts:71· 5 assertions

7/7 met /receipts/T-088

The live site streams these continuously off the work ledger — each one a permalink like /receipts/T-125. Shown here: five of eighty-nine.

§ 03 The schema 31.98° N

The receipt is a contract.

A receipt isn't prose we format nicely. It's a typed object with a published schema — so it renders the same everywhere, and so anything can read it.

verdict is an enum — pass · partial · fail. No prose "mostly done".
evidence is structured — file, line, test, assertion count.
surprises may be empty — but it is never omitted.

Published so your own tooling — or your own agents — can consume our receipts.

GET/receipts/schemajson-schema · draft 2020-12

{
  "$id": "https://oasisfactory.com/receipts/schema",
  "title": "Test Receipt",
  "type": "object",
  "required": ["id", "story", "verdict", "criteria"],
  "properties": {
    "id":       { "type": "string", "pattern": "^T-\d+$" },
    "story":    { "type": "string", "pattern": "^S-\d+$" },
    "verdict":  { "enum": ["pass", "partial", "fail"] },
    "criteria": { "type": "array", "minItems": 1,
                   "items": { "$ref": "#/$defs/criterion" } },
    "commands": { "type": "array", "items": { "type": "string" },
                   // copy-pasteable — the reader reproduces the verdict },
    "surprises": { "type": "array", "items": { "type": "string" },
                   // may be empty; never omitted }
  },
  "$defs": {
    "criterion": {
      "required": ["statement", "verdict", "evidence"],
      "properties": {
        "statement": { "type": "string" },
        "verdict":   { "enum": ["pass", "fail", "skipped"] },
        "evidence":  { "file": "string", "line": "integer",
                       "test": "string", "assertions": "integer" },
        "skip_reason": { "type": ["string", "null"] }
      }
    }
  }
}

§ 04 Why it works 32.71° N

Three reasons a receipt is worth more than a status update.

A status update asks for your trust. A receipt hands you the means to withhold it.

FalsifiableEvidence, not vibes

Every verdict cites a file, a line, and a named test. There's nothing to take on faith, because there's always something to open.

RunnableCommands, not screenshots

The verification is a command you can paste. Run it against the same commit and get the same result — or don't, and you've found something.

AccumulatedA moat of eighty-nine

Each receipt is minted at build time, against the commit that produced it. No one retrofits this — you can't back-fill evidence for work already shipped.

§ 05 Audit 33.50° N

Don't take the method on faith.

Read the construction record of the system that built itself — every arc, every story, every receipt, in the same substrate this page describes. If the receipts don't hold, you'll be the one to catch it.

Audit our work Bring us an intent