Lexicon Garden

dev.scopetrail.auditReceipt

A wrapper record publishing a signed OBO Audit Receipt to an AT Protocol repository. The signed receipt (a W3C Verifiable Credential, eddsa-jcs-2022 proof) is stored verbatim as an opaque JSON string in receiptJson — the only trusted field. All other properties are untrusted indexed mirrors, duplicated for discovery only; a verifier must re-parse receiptJson, check the mirrors match, then verify the Ed25519 proof before trusting anything. See PRD_ARCH.md §8.3 (Decision D-1).

Repository @reveluxlabs.bsky.social did:plc:bty3gmskhla7rwblq5zl5jm5 namespace authority
Details · record, key any
Kindrecord
Record keyany
Authorityscopetrail.dev
Indexed
Compare Edit in builder → Fork →

Record

record · key any

Properties

expirationDate

requiredstring · datetime

Untrusted mirror of receipt.expirationDate (ISO-8601 UTC expiry).

issuanceDate

requiredstring · datetime

Untrusted mirror of receipt.issuanceDate (ISO-8601 UTC mint time).

issuer

requiredstring · did

Untrusted mirror of receipt.issuer (the DID or URI of the receipt-issuing service). Verifiers must confirm this matches the parsed receiptJson before relying on it for discovery/filtering.

receiptJson

requiredstring

The complete, verbatim signed OBOAuditReceipt as a JSON string (exact JSON.stringify output of the receipt object — never reordered or reshaped). This is the only trusted field: verification re-parses it and checks the eddsa-jcs-2022 proof. Never reconstruct the receipt field-by-field from a native mapping (see §8.3 CBOR round-trip risk).

  • maxLength: 100000

schemaVersion

requiredstring

Version tag of the wrapped receipt payload shape. Fixed to 'obo-receipt/v1' for this lexicon revision.

  • const: "obo-receipt/v1"

subject

requiredstring · at-identifier

Untrusted mirror of receipt.credentialSubject.id (the leaf acting agent/service that is the receipt subject).

summary

requiredstring

Untrusted mirror of receipt.summary — the one-line, plain-English delegation summary, for feed/list UIs that render without fetching and verifying the full receipt.

  • maxLength: 500

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • build.clovernight.identity.verification

    record

    Identity verification status record — proves that a DID has been verified by a trusted verifier.

  • dev.keytrace.signature

    object

    A cryptographic signature attesting to a claim

  • network.attested.proof

    record not from the namespace authority

    A remote attestation proof: a standalone record in the attestor's repository that binds, via a canonical attestation CID, to a subject record living elsewhere. Referenced from the subject's `signatures` array via com.atproto.repo.strongRef. The `cid` is computed from the subject record (signatures stripped) with this record's metadata (cid/signature/signatures stripped, `repository` = subject's repo DID added) inserted as $sig, DAG-CBOR + SHA-256 + CIDv1. Verifiers recompute that CID and require

  • app.certified.signature.proof

    record

    A remote attestation proof record holding the CID of attested content. Lives in the attestor's repository and is referenced from the attested record's `signatures` array via `com.atproto.repo.strongRef`. Conforms to the ATProtocol Attestation Specification.