# description
A neutral third-party WITNESS receipt for a single robot / embodied-AI decision — the 'black box' record of what a robot was told and which model/policy decided, at the moment it acted. A profile of receipt/v1: the same flat, detached-Ed25519-signed envelope, so /verify.js and scripts/verify_awareness.py verify it unchanged. Privacy by construction: the caller hashes the decision inputs (sensor/awareness context) LOCALLY and sends only a fixed-length sha256 plus non-PII labels (robot class, the deciding model/policy id, the go/caution/no-go verdict acted on, an optional coarse region). Dynamic Feed never sees raw sensor data, precise location, or imagery. The receipt proves this decision record EXISTED within a time window and is INTACT (tamper-evident), and which agent key (if any) co-signed. It is ADVISORY EVIDENCE ONLY: it does NOT certify the action was safe, correct, or lawful, is NOT a safety system, and is NOT the actuator — the robot's own certified safety layer makes the decision. Provenance is not truth.

# properties.issuer.description
The witness. Verify its key at GET /.well-known/keys.

# properties.data.properties.content_hash.description
sha256 of the canonical decision record (robot_class, model_id, verdict, decision, inputs_sha256, awareness_ref, region, latency_ms).

# properties.data.properties.robot_class.description
The class of embodied system. Caller-supplied, non-PII.

# properties.data.properties.model_id.description
The model / policy identifier that made the decision (the robot's deciding 'brain'). Caller-supplied; Dynamic Feed does not independently verify which model ran.

# properties.data.properties.verdict.description
The go / caution / no-go verdict the robot acted on. Caller-supplied.

# properties.data.properties.decision.description
An optional short action label the robot took (e.g. 'takeoff', 'proceed', 'hold'). Caller-supplied, non-PII.

# properties.data.properties.inputs_sha256.description
sha256 of the decision inputs (sensor / awareness context), computed by the caller. The raw inputs are never sent to Dynamic Feed.

# properties.data.properties.awareness_ref.description
Optional opaque reference to a prior Dynamic Feed signed awareness snapshot (snapshot_id) the decision was grounded on — links the decision to the signed facts it was told.

# properties.data.properties.region.description
Optional COARSE region label (no precise coordinates). Caller-supplied, non-PII.

# properties.data.properties.latency_ms.description
Decision latency the caller observed, in milliseconds. Caller-supplied.

# properties.data.properties.window.description
Two-sided time bound. The lower field (a recent reference token committed inside the signed record) is the NOT-BEFORE lower bound; the notary log head is time-stamped by an independent RFC 3161 authority (POST /v1/anchor), which is the EXISTED-BY upper bound. The timestamp is instant and requires no account.

# properties.data.properties.agent.description
Optional BYO-key robot/agent co-signature, verified BEFORE witnessing ('the robot attested, Dynamic Feed witnessed').

# properties.data.properties.claim_boundary.description
The advisory-evidence, witness-only boundary, baked into the signed bytes so no log can strip it.

# properties.transparency.description
Linkage into the public append-only notary transparency log (GET /v1/notary/log); the log head is RFC 3161 timestamped daily.

# properties.signature.description
Detached Ed25519 signature over the canonical bytes of this envelope with the `signature` field removed (json-sorted-compact). Verify against GET /.well-known/keys.