AER-1 Field Reference
This reference follows current open draft -15. The JSON Schema applies directly to the result._receipt object in the live MCP response. Field names and values are preserved as transported.
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| id | UUID | yes | Stable receipt identity | 00000000-0000-4000-8000-000000000001 |
| tool | string | yes | Tool name as returned by MCP | live_price |
| timestamp | RFC 3339 string | yes | Transport timestamp; not created_at | 2026-10-04T12:00:00Z |
| receipt_schema_version | string | when present | Transport schema identifier | 0.3 |
| tool_context | object | when present | Tool name, version, and scope | { name, version, scope } |
| provenance_class | enum string | yes | v0.4 metadata_hash binds the provenance claim and receipt metadata; issuer not authenticated | EXECUTED BY ZAMBO |
| canonical_bytes | Base64 string | yes | Exact UTF-8 bytes used for hashing | e30= |
| canonical_byte_length | integer | yes | Length of canonical_bytes after Base64 decoding | 2 |
| hash_algorithm | string | yes | Hash algorithm identifier | sha256 |
| output_hash | string | yes | SHA-256 plus 64 lowercase hexadecimal digits | sha256:... |
| verification_status | string | yes | Verifier-computed status, not committed or trusted | execution_observed |
| status | string | yes | Raw result status, including failures | success |
Verification notes
Decode Base64 strictly, reject invalid UTF-8, validate the timestamp, hash the exact bytes, and never reserialize a payload before comparison. Verify both output_hash and metadata_hash. Compare outer and inner schema versions. Hash binding does not authenticate the issuer or prove execution. Historic v0.2/v0.3 receipts are marked: legacy receipt, provenance not cryptographically bound.
For the live MCP field correspondence, see the implementer's mapping table.