# Receipts

## Assumptions
- Every PA Auto-Triage and PPI decision must emit a verifiable receipt tying together data hash, policy digest, and CMS/HHS citations.
- Receipts double as contractual evidence, so they need to reference the same identifiers used in `/contracts` and `/decision_rules`.
- ⚠ Receipt retention expectations may shift if CMS issues future interoperability rulemaking; re-check retention guidance every release cycle.

## Open Questions
- Do we need separate receipt schemas for clinical reviewers vs. auditors, or can a single envelope with role-based views suffice?
- How do we persist receipts for payer-hosted deployments while keeping signing keys under our control?
- Should we integrate with existing payer ledger systems (e.g., Hyperledger) or keep a lightweight Merkle DAG inside Loom?

## Next Actions
- Draft `receipt_schema_pa_v1.json` and `receipt_schema_ppi_v1.json` with JCS canonicalization and deterministic IDs.
- Extend `tools/receipts/timestamp_anchor.py` so each receipt anchors to an external notary plus our internal ledger.
- Add regression tests ensuring all eval + prod pipelines refuse to run without a valid receipt configuration.

## Recent Additions
- `receipts/schemas/agent_run.v1.json` + `tools/agent_harness/runner.py` now emit signed Writer/Checker/Guardian receipts; examples live under `receipts/examples/agent/`.
- `receipts/schemas/ppi_hold.v1.json` + `receipts/schemas/override.v1.json` capture PPI hold and override flows with matching samples in `receipts/examples/ppi/`.

## Source Ledger
- See `/SourceLedger.md` for the canonical citations backing these statements.
