X00-06 — Verifiable receipts and content credentials for published artifacts #145

Outcome

Decide whether Loop's receipts and published artifacts should be independently verifiable outside Loop.

Parent and boundary

Parent: #110. This is an expansion candidate. Produce a value case, owning module, contract sketch, and threat notes, then record go, no-go, or defer. No implementation lands from this issue. A new public PDF, schema, worker, or workflow contract needs an architect checkpoint with concrete fixtures and migration behavior.

Grounding

• Loop's differentiator is evidence (roadmap §1), but receipts are verifiable only inside Loop today.
• Candidates: sign InspectionReceipt, Approval, and sign-off with a local key (a detached signature or a PAdES document timestamp); optionally attach C2PA content credentials that record correction provenance.

Decision inputs

• Key custody and revocation under local-first operation.
• Which artifacts carry which proof.
• Effect on PDF/X conformance and existing signatures.
• An independent verifier.
• Failure case: embedding provenance must never break a document's PDF/X conformance or invalidate a customer signature without disclosure.

Required proof

Decision record with the value case (user, frequency, current alternative, evidence), owning module, contract sketch, fixtures or corpus plan, independent oracle where a claim is made, and risks.

Handoff

State go, no-go, or defer. On go, file bounded implementation sub-issues under the owning module parent and link them here.

Sources

Approved master roadmap §5 · Gap review of the issue suite against the approved roadmap, 2026-09-27 · Depends on L01-02 (#16) and L04-07 (#39).