Course / Lesson 5 of 6
17 min · sanitized real case
The receipt graph
Objective: Link every derived value to a receipt re-derivable from the bytes — and pick the right field for each verification role.
First, in plain language
A receipt is the difference between "trust me" and "check it yourself". Every number the pipeline derives — a count, a text span, an alias — points to a receipt that an independent verifier recomputes from raw bytes, without reusing any self-assertion from whoever built it.
In the real mission, 535,326 receipts were verified with 0 problems — after an honest sequence of repairs that walked 3,826 problems down to zero, erasing none along the way.
Open the technical layer
Each receipt carries fields with distinct roles:
| Field | Verification role |
|---|---|
snapshot_sha256 | Proves the file's bytes have not changed since processing. |
locator bounds (offset pair) | Where the span lives: start and end byte inside that file. |
span_sha256 | Hash of the span's content — useful for integrity, ambiguous for attribution. |
record_id | Content-addressed id of the derived record: stable, dedupable identity. |
coverage_root | Per-item coverage root: proves the whole item was swept. |
The offset-pair case. The corpus has genuinely duplicate content: backup aliases and content twins. Under duplicates, two spans at different positions share the same span_sha256 — the hash cannot say which occurrence produced the record. Final attribution was made by exact offset pair: an aggregate span belongs to an item if it is contained in the item's declared range and the file hash matches. Result: 1,285/1,285 spans attributed against a ground-truth sidecar; span_sha256 is never used for attribution.
Negative controls. The verifier passed 9/9 sabotages: altered id, shifted span, removed rule, fraudulent empty list, stale HEAD, reconciliation replay. A receipt graph that only accepts the good cases proves nothing.
Why a "path" is not a receipt
A path can be renamed, moved (remember lesson 2's drift), or fabricated. In the mission, 24 ephemeral aliases on synthetic paths became the documented class path_presence:"absent": evidence by hash, never by fabricated path. The receipt anchors on the byte, not the name.
Drag each receipt field to its verification role
For each receipt field, choose the role it fulfils. One of them is this lesson's trap.