Module receipt 

tatara-receipt/v1 — the typed receipt envelope every pleme-io Job emits to prove its work was done.

Today’s consumers (and the only ones supported on tatara-receipt/v1):

• closed-loop auth probes — kind = "closed-loop-auth". Stamps that a system’s bundled identity issuer authenticated its bundled client. The substrate primitive every closed-loop-testable product composes (Akeyless gator↔gateway, future: identity providers, message brokers, databases that can issue creds to themselves).
• schema/migration runs — kind = "db-migration". shinka emits one per applied migration; pillars carry the diff hash.
• test suites — kind = "test-suite". kenshi-runner et al.
• nix builds — kind = "nix-build". Carries the store-path pillar as artifact_hash.
• Anything else — operators register new kind strings; the schema is open by design (the shape is fixed; the kind is data).

Lives in tatara-process so ReceiptEnvelope → ProcessAttestation is a local typed bridge — the reconciler’s verifier and any future Process consumer share one parse.

Wire format (snake_case to match the existing ConfigMap payload shape the akeyless-closed-loop-probe chart writes):

version: tatara-receipt/v1
kind: closed-loop-auth
composed_root: <26-char hex>
intent_hash:   <hex>
artifact_hash: <hex>
control_hash:  <hex>
generated_at:  2026-05-19T22:00:00Z
process_ref:   "akeyless-test/ephemeral-akeyless"   # optional
evidence:      { ... }                              # optional, free-form

Structs

ReceiptEnvelope

Typed receipt envelope. Any Job in pleme-io that wants its result to chain into a Process’s status.attestation writes one of these.

UnknownReceiptKind

Enums

ReceiptError

Why a receipt is rejected. Kept as a typed enum so callers can pattern-match on the failure mode and surface targeted operator messages.

ReceiptKind

Closed-set typed identifier for the four known ReceiptEnvelope::kind strings the substrate emits today — Self::ClosedLoopAuth → "closed-loop-auth", Self::DbMigration → "db-migration", Self::TestSuite → "test-suite", Self::NixBuild → "nix-build" — as a Rust enum, so the (variant, canonical kebab-case kind, semantic role) triple binds at ONE site on the typed algebra rather than at the four byte-identical string-literal sites scattered across the closed-loop probe binary (default_value on --receipt-kind), the reconciler’s receipt-parser tests, the ephemeral_pipeline integration test, and the future shinka / kenshi / nix-build Job authors that compose ReceiptEnvelope::build.

Constants

RECEIPT_VERSION

Canonical version string. Bump → tatara-receipt/v2 if the wire shape changes; parsers refuse anything else for the v1 reader.