Receipts

A receipt is the durable, verifiable record that an operation happened and what it cost.

Today the Disposer seals each action as an Action Receipt: canonical JSON, hashed with BLAKE3 and signed with Ed25519, so the same action always yields the same bytes. Its joule figure does not yet carry the meter that produced it, and in the demo it comes from a formula, not a reading. It is not yet JCR-1, so JCR-1 verifiers cannot check it.

Next, every act is sealed in JCR-1, the Transaction Science family’s shared format, with the meter’s source, window and boundary inside the signed part. Joule Cloud’s servers already seal JCR-1 receipts with measured joules that an independent verifier has checked.

The JCR-1 format

JCR-1 is canonical det-CBOR + COSE_Sign1 / EdDSA:

• Deterministic CBOR so the same logical receipt always serializes to the same bytes (and the same content address).
• COSE_Sign1 with an Ed25519 signature, so authenticity is a signature check, not a trust relationship.

What it carries

{
  "kind":   "jouleos.<op>",
  "joules": { "measured": <µJ>, "estimated": <µJ> },
  "prov":   "AmuAgx | Rapl | Estimator",
  "class":  "W_render | W_infer | W_storage | …",
  "sig":    "ed25519:…"
}

The two-part measured + estimated cost with its provenance tag is the same honesty rule as the energy oracle: the receipt never serializes an estimate as if it were measured (Estimator can never claim to be AmuAgx).

Why it matters

Because the receipt is content-addressed and signed, re-verification is resolution-free — you can check it offline, forever, without contacting the issuer. Audit becomes a property of the log, not a separate process run against it.