SIMULATED SAMPLE

This report was generated from the committed dry-run fixture in the Bolyra repository by the shipped report tool, @bolyra/operator-trial report 0.1.0 with @bolyra/receipts 0.11.0 (re-verify command pinned to @bolyra/cli@0.9.0). The fixture came from a dry run: simulated credentials, an ephemeral signer, no proof verification, a built-in localhost echo endpoint, no customer endpoint. It shows the deliverable's form and limits, not a customer run, and it is not evidence that anyone uses Bolyra.

The anchors below (signer, receipt count, head hash) were copied from the bundle's own files, so they establish consistency with the bundle only, not signer identity or completeness. Status counts: SIGNED 18 · OBSERVED 12 · DERIVED 21 · ABSENT 27 · FAILED 0. Missing evidence is printed as ABSENT and failed checks as FAILED; nothing is filtered.

Files. report.json (same findings as this page) · input bundle: receipts.jsonl · summary.json · signer.json · VERIFY.txt · source at commit 93239a88 (tool and fixture) · back to the acceptance-exercise offer.

Reproduce. Node 20 or newer. This regenerates report.html and report.json. Compared with the published files, report.json differs only in the generation timestamp; report.html additionally lacks this banner and the "SIMULATED sample:" title prefix, which the publication step (landing/evidence-sample/build.mjs) adds around the unchanged report. Source manifest sha256 (report tool + fixture) b8dc3eaa6d6daecda471727e5efe9d31f6aa8cc885a3bd5b8dad5ac9d902951c.

git clone https://github.com/bolyra/bolyra.git && cd bolyra && git checkout 93239a88
cd examples/operator-trial && npm ci
npm run report -- --bundle test/report-fixtures/dry-run --signer 0xb1f30bddf40612b8aa0634d5ca5c21aa5a2f5dff --expect-count 3 --expect-head 0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1

The Re-verify yourself command further down verifies the receipt chain with the published CLI; it does not reproduce the report's own findings (the id check B1a is report-local).

Reviewer evidence report

Bundle dry-run, generated 2026-10-18T19:37:01.419Z by @bolyra/operator-trial report 0.1.0 using @bolyra/receipts 0.11.0.

What this report is. For each claim a reviewer might make about this bundle, it says whether the bundle supports it, by which artifact and field, and with what kind of evidence. It makes no judgement beyond that: no score, no verdict, no certification.

What produced the bundle. The shipped operator-trial 0.1.0 runs the gateway with devMode: true and static simulated credentials (examples/operator-trial/src/gateway-config.ts), signs receipts with an ephemeral key, and verifies no zero-knowledge proof. This is a property of the implementation that produced bundles of this shape; it is not something this bundle proves about itself.

What this report never claims. That the endpoint executed anything, that a human consented, who receives funds or controls a settlement address, that a spend limit applied, that any subject was authenticated, or that production credentials were used. Where such a claim appears below, its status is ABSENT.

Anchors

Anchor	Value	Source
signer	`0xb1f30bddf40612b8aa0634d5ca5c21aa5a2f5dff`	command line (--signer)
receipt count	3	command line (--expect-count)
head hash	`0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1`	command line (--expect-head)

Values were supplied through command-line flags. Their independence from this bundle is unknown. Copying signer/count/head from bundle files establishes consistency with those supplied values; it does not establish signer identity or independently establish completeness. External assurance requires a separately trusted signer reference and checkpoint.

Summary of statuses

SIGNED: 18 · OBSERVED: 12 · DERIVED: 21 · ABSENT: 27 · FAILED: 0

Bundle-level findings

#	Claim	Status	Evidence	Note
B2	Receipts form one intact hash chain (genesis, seq, prevReceiptHash, stored receiptHash)	DERIVED	`receipts.jsonl` inputs: verifyReceiptChain(@bolyra/receipts) with expectedSigner = anchor; log: 3 receipt line(s)	3 receipt(s), 3 chained; recomputed head hash 0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1
B3a	Receipt count matches the supplied count checkpoint	DERIVED	`receipts.jsonl` inputs: --expect-count 3; log: 3 receipt line(s)	count matches the supplied checkpoint.
B3b	Hash of the last readable chained receipt matches the supplied head checkpoint	DERIVED	`receipts.jsonl line 3` inputs: --expect-head 0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1; recomputed: 0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1, the recomputed hash of the last readable chained receipt (line 3)	the supplied checkpoint equals 0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1, the recomputed hash of the last readable chained receipt (line 3).
B8a	Host's unsigned receiptCount equals the number of receipt lines	OBSERVED	`summary.json receiptCount` `receipts.jsonl`	receiptCount 3 (unsigned) equals the number of receipt lines.
B8b	Host's unsigned headReceiptHash equals the recomputed hash of the last readable chained receipt	OBSERVED	`summary.json headReceiptHash` `receipts.jsonl line 3`	headReceiptHash (unsigned) equals 0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1, the recomputed hash of the last readable chained receipt (line 3).
B4	Signer in signer.json equals the supplied signer anchor	DERIVED	`signer.json signer` inputs: --signer 0xb1f30bddf40612b8aa0634d5ca5c21aa5a2f5dff	matches the supplied anchor.
B6	Host reports an ephemeral signer	OBSERVED	`signer.json ephemeral`	the host asserts the key was generated for this run; no key-destruction claim follows.
B4b	VERIFY.txt names the anchored signer (compared, never used as an anchor)	OBSERVED	`VERIFY.txt`	VERIFY.txt names the anchored signer (unsigned text; not used as an anchor).
B5	Proof verification mode	ABSENT	none	the bundle does not record whether proofs were verified. Separately: the shipped operator-trial 0.1.0 runs the gateway with devMode: true and static simulated credentials (examples/operator-trial/src/gateway-config.ts); that is a property of the implementation, not authenticated provenance of this bundle.
B7	Host-reported dry-run flag	OBSERVED	`summary.json dryRun`	dryRun: true (the host reports the built-in echo endpoint was used).

Per receipt line

#	line	Claim	Status	Evidence	Note
B1	1	Receipt's signature recovers to the anchored signer and its payload hash recomputes	DERIVED	`receipts.jsonl line 1 signature.value` `receipts.jsonl line 1 signature.payloadHash` inputs: verifyReceipt(@bolyra/receipts) with expectedSigner = 0xb1f30bddf40612b8aa0634d5ca5c21aa5a2f5dff	signature recovered to the anchor; payload hash recomputed.
B1	2	Receipt's signature recovers to the anchored signer and its payload hash recomputes	DERIVED	`receipts.jsonl line 2 signature.value` `receipts.jsonl line 2 signature.payloadHash` inputs: verifyReceipt(@bolyra/receipts) with expectedSigner = 0xb1f30bddf40612b8aa0634d5ca5c21aa5a2f5dff	signature recovered to the anchor; payload hash recomputed.
B1	3	Receipt's signature recovers to the anchored signer and its payload hash recomputes	DERIVED	`receipts.jsonl line 3 signature.value` `receipts.jsonl line 3 signature.payloadHash` inputs: verifyReceipt(@bolyra/receipts) with expectedSigner = 0xb1f30bddf40612b8aa0634d5ca5c21aa5a2f5dff	signature recovered to the anchor; payload hash recomputed.
B1a	1	Receipt's id equals the first 18 characters of its stored payload hash and is unique in the log	DERIVED	`receipts.jsonl line 1 id` `receipts.jsonl line 1 signature.payloadHash` inputs: report-local check: id === signature.payloadHash.slice(0, 18) and unique; not covered by @bolyra/receipts or @bolyra/cli	consistent with the stored payload hash and unique in the log. Authenticity of the hash itself is B1.
B1a	2	Receipt's id equals the first 18 characters of its stored payload hash and is unique in the log	DERIVED	`receipts.jsonl line 2 id` `receipts.jsonl line 2 signature.payloadHash` inputs: report-local check: id === signature.payloadHash.slice(0, 18) and unique; not covered by @bolyra/receipts or @bolyra/cli	consistent with the stored payload hash and unique in the log. Authenticity of the hash itself is B1.
B1a	3	Receipt's id equals the first 18 characters of its stored payload hash and is unique in the log	DERIVED	`receipts.jsonl line 3 id` `receipts.jsonl line 3 signature.payloadHash` inputs: report-local check: id === signature.payloadHash.slice(0, 18) and unique; not covered by @bolyra/receipts or @bolyra/cli	consistent with the stored payload hash and unique in the log. Authenticity of the hash itself is B1.

Attempt 1

#	Claim	Status	Evidence	Note
A1	The summary's receipt id names exactly one valid receipt in the log	DERIVED	`summary.json attempts[0].receiptId` `receipts.jsonl line 1 id` inputs: receiptId 0x6f82e3b05de9c571	names receipt line 1.
A2	Decision (allow / deny)	SIGNED	`receipts.jsonl line 1 payload.decision.allowed`	allow
A3	Decision reason text	SIGNED	`receipts.jsonl line 1 payload.decision.reasonCode`	"allowed \| action=echo-action POST 127.0.0.1:53727/echo"
A4b	Action descriptor parsed from the signed reason text (operator-trial convention, not a receipt schema field)	DERIVED	`receipts.jsonl line 1 payload.decision.reasonCode` inputs: rule: trailing " \| action=<name> <METHOD> <host><path>"	echo-action POST 127.0.0.1:53727/echo
A4c	Recorded action and signed action descriptor agree	DERIVED	`summary.json action` `receipts.jsonl line 1 payload.decision.reasonCode` inputs: A4a@1; A4b@1	the unsigned record and the signed descriptor name the same action.
A5	Signer-asserted simulated subject identifiers; subject authentication is not established	SIGNED	`receipts.jsonl line 1 payload.subject`	rootDid did:bolyra:dev:000000000000000000000000000000000ef9f5257e42e60d82de43ef46cc2ff0; actingDid did:bolyra:dev:000000000000000000000000000000000ef9f5257e42e60d82de43ef46cc2ff0; commitments 19907046019634888722304576993792634864 / 19907046019634888722304576993792634864. Dev DIDs from a simulated credential; these identify a key material commitment, not a person or legal entity.
A6	Recorded permission bitmask	SIGNED	`receipts.jsonl line 1 payload.decision.permissionBitmask`	permissionBitmask 2.
A8a	Nonce	SIGNED	`receipts.jsonl line 1 payload.proof.nonce`	nonce 33050125237918531785092188808
A9a	Proof hashes	SIGNED	`receipts.jsonl line 1 payload.proof`	humanProofHash 2d56104a64b95a80432c6e2f0e485eeb6f6f6ece2d1ad8ccfd8537801605a718; agentProofHash 2d56104a64b95a80432c6e2f0e485eeb6f6f6ece2d1ad8ccfd8537801605a718; publicSignalsHash d0087fedfb3948873668c23bda78b8bf45a628406760400113c4de96b46cdc8a. Hashes only; see A9b.
A4a	Action name, method, host, path as the host recorded them	OBSERVED	`summary.json action`	echo-action POST 127.0.0.1:53727/echo
A7a	Permission the host configured as required	ABSENT	none	the required permission is host configuration; the bundle does not carry it in signed or unsigned form.
A9b	Human and agent proofs were verified	ABSENT	none	the bundle provides no evidence that any proof was verified; A9a lists hashes only. Separately: the shipped operator-trial 0.1.0 disables proof verification (dev mode; see B5).
A10	Host reports invoking fetch toward the endpoint; delivery and execution unproven	OBSERVED	`summary.json attempts[0].dispatched`	dispatched: true. 'dispatched' means the host reports invoking fetch; delivery and execution at the endpoint are not proven.
A11	Upstream HTTP status	OBSERVED	`summary.json attempts[0].upstreamStatus`	upstreamStatus: 200 (as observed by the host).
A12	Decision was signed before dispatch	ABSENT	none	the bundle holds no ordering evidence. The host's code verifies the persisted receipt before dispatching, but the bundle does not record that.
A13	The endpoint executed the action	ABSENT	none	never claimed by the trial; an upstream status is the host's observation of a response, not proof of execution.
A14	A human consented to this action	ABSENT	none	no consent artifact exists in the bundle.
A15	A mandate or spend limit bounded this action	ABSENT	none	the receipt records a permission tier mask only; there is no cumulative budget, and this is an auth receipt, not a commerce receipt.
A16	Who receives funds or controls a settlement address	ABSENT	none	nothing in the bundle names a payee, a settlement address, or who controls one.
A17	Production credentials or registry were used	ABSENT	none	see B5: simulated credentials, no registry.

Attempt 2

#	Claim	Status	Evidence	Note
A1	The summary's receipt id names exactly one valid receipt in the log	DERIVED	`summary.json attempts[1].receiptId` `receipts.jsonl line 2 id` inputs: receiptId 0xf139357ce998561b	names receipt line 2.
A2	Decision (allow / deny)	SIGNED	`receipts.jsonl line 2 payload.decision.allowed`	deny
A3	Decision reason text	SIGNED	`receipts.jsonl line 2 payload.decision.reasonCode`	"policy_denied: Tool "echo-action" requires permissions 10b, agent has 1b \| action=echo-action POST 127.0.0.1:53727/echo"
A4b	Action descriptor parsed from the signed reason text (operator-trial convention, not a receipt schema field)	DERIVED	`receipts.jsonl line 2 payload.decision.reasonCode` inputs: rule: trailing " \| action=<name> <METHOD> <host><path>"	echo-action POST 127.0.0.1:53727/echo
A4c	Recorded action and signed action descriptor agree	DERIVED	`summary.json action` `receipts.jsonl line 2 payload.decision.reasonCode` inputs: A4a@2; A4b@2	the unsigned record and the signed descriptor name the same action.
A5	Signer-asserted simulated subject identifiers; subject authentication is not established	SIGNED	`receipts.jsonl line 2 payload.subject`	rootDid did:bolyra:dev:000000000000000000000000000000001ade2c3d19dcd4de118b34bd618d259f; actingDid did:bolyra:dev:000000000000000000000000000000001ade2c3d19dcd4de118b34bd618d259f; commitments 35713515059947112636640560610871682463 / 35713515059947112636640560610871682463. Dev DIDs from a simulated credential; these identify a key material commitment, not a person or legal entity.
A6	Recorded permission bitmask	SIGNED	`receipts.jsonl line 2 payload.decision.permissionBitmask`	permissionBitmask 1.
A7b	Required mask as reported in the denial text (reported, not the enforced configuration)	DERIVED	`receipts.jsonl line 2 payload.decision.reasonCode` inputs: rule: "requires permissions <mask>, agent has <mask>" in the signed reason text	reported required 10b, agent 1b; this is what the host wrote into the reason, not the enforced configuration.
A8a	Nonce	SIGNED	`receipts.jsonl line 2 payload.proof.nonce`	nonce 33050125250618937014349418370
A9a	Proof hashes	SIGNED	`receipts.jsonl line 2 payload.proof`	humanProofHash 8b969a16da2a9f7ed464c1b5aaa66f8f9f47ba4c55e2a98677e0b7461f174f2b; agentProofHash 8b969a16da2a9f7ed464c1b5aaa66f8f9f47ba4c55e2a98677e0b7461f174f2b; publicSignalsHash 79ac2a7880d69b586ecea46a9c5454d080f485f7d3e85cdb30297a72c5ef98f6. Hashes only; see A9b.
A4a	Action name, method, host, path as the host recorded them	OBSERVED	`summary.json action`	echo-action POST 127.0.0.1:53727/echo
A7a	Permission the host configured as required	ABSENT	none	the required permission is host configuration; the bundle does not carry it in signed or unsigned form.
A9b	Human and agent proofs were verified	ABSENT	none	the bundle provides no evidence that any proof was verified; A9a lists hashes only. Separately: the shipped operator-trial 0.1.0 disables proof verification (dev mode; see B5).
A10	Host reports invoking fetch toward the endpoint; delivery and execution unproven	OBSERVED	`summary.json attempts[1].dispatched`	dispatched: false. 'dispatched' means the host reports invoking fetch; delivery and execution at the endpoint are not proven.
A11	Upstream HTTP status	ABSENT	none	no upstream status was recorded.
A12	Decision was signed before dispatch	ABSENT	none	the bundle holds no ordering evidence. The host's code verifies the persisted receipt before dispatching, but the bundle does not record that.
A13	The endpoint executed the action	ABSENT	none	never claimed by the trial; an upstream status is the host's observation of a response, not proof of execution.
A14	A human consented to this action	ABSENT	none	no consent artifact exists in the bundle.
A15	A mandate or spend limit bounded this action	ABSENT	none	the receipt records a permission tier mask only; there is no cumulative budget, and this is an auth receipt, not a commerce receipt.
A16	Who receives funds or controls a settlement address	ABSENT	none	nothing in the bundle names a payee, a settlement address, or who controls one.
A17	Production credentials or registry were used	ABSENT	none	see B5: simulated credentials, no registry.

Attempt 3

#	Claim	Status	Evidence	Note
A1	The summary's receipt id names exactly one valid receipt in the log	DERIVED	`summary.json attempts[2].receiptId` `receipts.jsonl line 3 id` inputs: receiptId 0xce71d54449634289	names receipt line 3.
A2	Decision (allow / deny)	SIGNED	`receipts.jsonl line 3 payload.decision.allowed`	deny
A3	Decision reason text	SIGNED	`receipts.jsonl line 3 payload.decision.reasonCode`	"authentication_failed: Nonce already used — proof replay rejected [tool: echo-action] \| action=echo-action POST 127.0.0.1:53727/echo"
A4b	Action descriptor parsed from the signed reason text (operator-trial convention, not a receipt schema field)	DERIVED	`receipts.jsonl line 3 payload.decision.reasonCode` inputs: rule: trailing " \| action=<name> <METHOD> <host><path>"	echo-action POST 127.0.0.1:53727/echo
A4c	Recorded action and signed action descriptor agree	DERIVED	`summary.json action` `receipts.jsonl line 3 payload.decision.reasonCode` inputs: A4a@3; A4b@3	the unsigned record and the signed descriptor name the same action.
A5	Signer-asserted simulated subject identifiers; subject authentication is not established	SIGNED	`receipts.jsonl line 3 payload.subject`	rootDid did:bolyra:dev:000000000000000000000000000000000ef9f5257e42e60d82de43ef46cc2ff0; actingDid did:bolyra:dev:000000000000000000000000000000000ef9f5257e42e60d82de43ef46cc2ff0; commitments 19907046019634888722304576993792634864 / 19907046019634888722304576993792634864. Dev DIDs from a simulated credential; these identify a key material commitment, not a person or legal entity.
A6	Recorded permission bitmask	SIGNED	`receipts.jsonl line 3 payload.decision.permissionBitmask`	permissionBitmask 0. Implementation note (not from the bundle): in the shipped trial, attempt 3 is the replay; the gateway's failure default for a replay is 0 because verification fails before tool policy runs, so a 0 here is not evidence that permissions were evaluated.
A8a	Nonce	SIGNED	`receipts.jsonl line 3 payload.proof.nonce`	nonce 33050125237918531785092188808
A9a	Proof hashes	SIGNED	`receipts.jsonl line 3 payload.proof`	humanProofHash 2d56104a64b95a80432c6e2f0e485eeb6f6f6ece2d1ad8ccfd8537801605a718; agentProofHash 2d56104a64b95a80432c6e2f0e485eeb6f6f6ece2d1ad8ccfd8537801605a718; publicSignalsHash d0087fedfb3948873668c23bda78b8bf45a628406760400113c4de96b46cdc8a. Hashes only; see A9b.
A4a	Action name, method, host, path as the host recorded them	OBSERVED	`summary.json action`	echo-action POST 127.0.0.1:53727/echo
A7a	Permission the host configured as required	ABSENT	none	the required permission is host configuration; the bundle does not carry it in signed or unsigned form.
A9b	Human and agent proofs were verified	ABSENT	none	the bundle provides no evidence that any proof was verified; A9a lists hashes only. Separately: the shipped operator-trial 0.1.0 disables proof verification (dev mode; see B5).
A10	Host reports invoking fetch toward the endpoint; delivery and execution unproven	OBSERVED	`summary.json attempts[2].dispatched`	dispatched: false. 'dispatched' means the host reports invoking fetch; delivery and execution at the endpoint are not proven.
A11	Upstream HTTP status	ABSENT	none	no upstream status was recorded.
A12	Decision was signed before dispatch	ABSENT	none	the bundle holds no ordering evidence. The host's code verifies the persisted receipt before dispatching, but the bundle does not record that.
A13	The endpoint executed the action	ABSENT	none	never claimed by the trial; an upstream status is the host's observation of a response, not proof of execution.
A14	A human consented to this action	ABSENT	none	no consent artifact exists in the bundle.
A15	A mandate or spend limit bounded this action	ABSENT	none	the receipt records a permission tier mask only; there is no cumulative budget, and this is an auth receipt, not a commerce receipt.
A16	Who receives funds or controls a settlement address	ABSENT	none	nothing in the bundle names a payee, a settlement address, or who controls one.
A17	Production credentials or registry were used	ABSENT	none	see B5: simulated credentials, no registry.
A8b	Attempt presented attempt 1's nonce and was denied	DERIVED	`receipts.jsonl line 1 payload.proof.nonce` `receipts.jsonl line 3 payload.proof.nonce` `receipts.jsonl line 3 payload.decision.allowed` inputs: A1@1; A1@3; A8a@1; A8a@3; A2@3	same signed nonce as attempt 1, and the decision was deny.

Re-verify yourself

From the bundle directory, with Node 20 or newer (the first run downloads the pinned CLI):

npx @bolyra/cli@0.9.0 receipt verify-chain ./receipts.jsonl --signer 0xb1f30bddf40612b8aa0634d5ca5c21aa5a2f5dff --expect-count 3 --expect-head 0xba154095cb6bdf6dfc8351519faabdebf64598dfcda3f8e978f934cfaf65b3f1

Change payload.decision.allowed in any receipt line without re-signing and re-run the command: expect FAIL line <n>: [signature-invalid] for that line, possibly with additional chain failures. The id check in this report (B1a) is not part of the CLI's output.

Status legend

SIGNED: An authenticated signer assertion, not independently established truth: the value is inside a receipt payload whose ES256K signature recovered to the anchored signer and whose payload hash recomputed.
OBSERVED: An unsigned host assertion: recorded by the trial host, signed by nothing.
DERIVED: A conclusion this report computes from SIGNED or OBSERVED values, reviewer anchors, or a named check; the row names its inputs and the rule.
ABSENT: No supporting evidence for this claim in the bundle. The row says what would be needed.
FAILED: Evidence is present and a named check on it failed, or two sources contradict.

Claim titles are fixed in the generating tool (claims.ts); the bundle cannot add or remove a claim.