Aarloven

Receipts · EspoCRM lead → customer

Two receipts. Check them yourself.

Each receipt is signed by the room with Ed25519 over its canonical JSON (sorted keys, no spaces, every field except the signature). The PASS receipt names the hash of the FAIL receipt before it, so the failed run cannot be quietly removed.

Today · operator-run sandbox, our machineNext · self-serve sealed API, AWS Nitro Enclave

Receiptr-62d6b6FAIL

Build v1.3 · 2026-10-02 12:26 UTC

  • C1A person without permission cannot turn a lead into a customer.Yes
  • C2When the same customer already exists, conversion stops.Noif it fails → Hold milestone 2. 10-day fix window, then retest.
  • C3After conversion, the lead is marked converted.Yes
Wall
network blocked · writes blocked · reads blocked
Inputs
build 8ddd…e634 · tests 9b76…0109 · data 6dd5…c427
Lock
63f7…6e04 (same clauses for both runs)
Workspace
deleted after the run · proof: none yet
Chain
previous receipt 08af…224f
Signed
Ed25519 · key 6967c16b56f94b95

What happens next: clause C2 names the action. Milestone 2 is held, the seller gets a 10-day fix window, then the same locked clauses run again.

Receipt JSON
Receiptr-3f7f34PASS

Build v1.4 · 2026-10-02 12:26 UTC

  • C1A person without permission cannot turn a lead into a customer.Yes
  • C2When the same customer already exists, conversion stops.Yes
  • C3After conversion, the lead is marked converted.Yes
Wall
network blocked · writes blocked · reads blocked
Inputs
build f83c…7d59 · tests 9b76…0109 · data 6dd5…c427
Lock
63f7…6e04 (same clauses for both runs)
Workspace
deleted after the run · proof: none yet
Chain
chained to the FAIL receipt r-62d6b6, so the failed run stays on record
Signed
Ed25519 · key 6967c16b56f94b95

What happens next: the buyer decides whether to sign and accept. The room never signs.

Receipt JSON

In full

FAIL · r-62d6b6 build v1.3

{
  "v": 1,
  "run": "r-62d6b6",
  "room": {
    "id": "r-6967",
    "host": "dev machine",
    "region": null,
    "where": "dev machine \u00b7 not a cloud region",
    "isolation": "macos-seatbelt",
    "code": "sha256:70f773f00785e5db4f96d16e2277b4302d17a5bfd5f3d48111886a0e46dc6c36"
  },
  "started": "2026-10-02T12:26:09.573Z",
  "finished": "2026-10-02T12:26:09.686Z",
  "sample": "espocrm-lead-convert",
  "build": "v1.3",
  "kept": [
    "C1",
    "C2",
    "C3"
  ],
  "inputs": {
    "build": "sha256:8dddef1ca7d0455ebf9a26f72a69a0216f5b8826ad51515f142fd2d232bbe634",
    "tests": "sha256:9b767b9a5e3fd04d75cd3184dd3f22b85d4dfb40a009ef63d1d87104fe5a0109",
    "data": "sha256:6dd5c6e2a744cd3d35b8de9fdf9538eb448ef09220f6af506f4d1e1bae1ac427",
    "lock": "sha256:63f767f6e8d61914ad26900955ef1ff8445ee26d905a8c00be4058f1efd96e04"
  },
  "wall": {
    "writes": "blocked",
    "reads": "blocked",
    "network": "blocked"
  },
  "results": [
    {
      "id": "C1",
      "judgment": "Yes",
      "ms": 25,
      "output": "sha256:66275efa89700fe15218e9cbaad59540d1a4eddf73fcb12ad168107fbb86cb9c"
    },
    {
      "id": "C2",
      "judgment": "No",
      "ms": 26,
      "output": "sha256:72f2f8b0da85d183291e266a77a68e854824776dec893d9e8e7e9cb077bb1eb9"
    },
    {
      "id": "C3",
      "judgment": "Yes",
      "ms": 24,
      "output": "sha256:9851961805d43960f2731af737ac8597b29780a927415351787ffd67efcd2550"
    }
  ],
  "verdict": "fail",
  "retention": {
    "workspace": "deleted after the run",
    "proof": "none yet"
  },
  "prev": "sha256:08afbee05dfaff4a1eb7bd3f889425e007e3270730d98b3f94f7c74d60e5224f",
  "key": "6967c16b56f94b95",
  "sig": "9JlLIdxOCHierZFV9g4381gcGQHhnV8rDa5Rb4bakUhovKhIqSQMVu38vFxmJgmTr0r0eX1HYykE20A5WNu2Aw=="
}

PASS · r-3f7f34 build v1.4

{
  "v": 1,
  "run": "r-3f7f34",
  "room": {
    "id": "r-6967",
    "host": "dev machine",
    "region": null,
    "where": "dev machine \u00b7 not a cloud region",
    "isolation": "macos-seatbelt",
    "code": "sha256:70f773f00785e5db4f96d16e2277b4302d17a5bfd5f3d48111886a0e46dc6c36"
  },
  "started": "2026-10-02T12:26:09.836Z",
  "finished": "2026-10-02T12:26:09.940Z",
  "sample": "espocrm-lead-convert",
  "build": "v1.4",
  "kept": [
    "C1",
    "C2",
    "C3"
  ],
  "inputs": {
    "build": "sha256:f83c8c14e997f29f250a39b51987d5316522f972ca0460affdfcfe270cc27d59",
    "tests": "sha256:9b767b9a5e3fd04d75cd3184dd3f22b85d4dfb40a009ef63d1d87104fe5a0109",
    "data": "sha256:6dd5c6e2a744cd3d35b8de9fdf9538eb448ef09220f6af506f4d1e1bae1ac427",
    "lock": "sha256:63f767f6e8d61914ad26900955ef1ff8445ee26d905a8c00be4058f1efd96e04"
  },
  "wall": {
    "writes": "blocked",
    "reads": "blocked",
    "network": "blocked"
  },
  "results": [
    {
      "id": "C1",
      "judgment": "Yes",
      "ms": 26,
      "output": "sha256:66275efa89700fe15218e9cbaad59540d1a4eddf73fcb12ad168107fbb86cb9c"
    },
    {
      "id": "C2",
      "judgment": "Yes",
      "ms": 24,
      "output": "sha256:acf3cda26885ad0eec668eebc46c1f27f08594d4d6035c82ae15b77572d5869d"
    },
    {
      "id": "C3",
      "judgment": "Yes",
      "ms": 25,
      "output": "sha256:9851961805d43960f2731af737ac8597b29780a927415351787ffd67efcd2550"
    }
  ],
  "verdict": "pass",
  "retention": {
    "workspace": "deleted after the run",
    "proof": "none yet"
  },
  "prev": "sha256:0a62546a2a1950422736bcd146a13ee41b17b0ec7c2c49ef5c322a32e92c98a8",
  "key": "6967c16b56f94b95",
  "sig": "9c+LdrY1z9gsCm4S1ejkDHYjvY4qtBcyOELkGARoNQ0EicLg+edUC8Hv5WucT8BNW/bVsMLuzVS4gftu7jN1DQ=="
}

13 lines differ: the run and its times, the build and its hash, three timings, clause C2's answer and its output, the verdict, the chain link and the signature. The tests, the data, the locked clauses and the room's code are the same in both.

Room public key · 6967c16b56f94b95

{
  "alg": "Ed25519",
  "spki": "MCowBQYDK2VwAyEAZnQYJj5LAkKqEvWHtginwmaFOeU6ShQFRR4/CIwWCOU=",
  "id": "6967c16b56f94b95",
  "room": "r-6967",
  "note": "Public key of the operator-run room that signed these receipts. Pin it; the private key never leaves the room."
}

To check on your own machine: remove sig, write the rest as canonical JSON, and verify the base64 signature with this Ed25519 key (SPKI, DER, base64). For the chain, the PASS receipt's prev must equal sha256: + the SHA-256 of the FAIL receipt's canonical JSON, signature included.

What these receipts do and do not show

Honest about the boundaries.

Today
Next
Who runs it
We run it for you (operator-run)
Where
Our machine · not a cloud region
Isolation
macOS sandbox: no network, writes only in the workspace
Trust root
Ed25519-signed, hash-chained receipts; room code hash self-reported
Deletion
Workspace deleted by our code; not proven
Sample
EspoCRM lead → customer, synthetic leads

The trust comes from the enclave measurement and the key seal, not from any database of approved software. The clause library is business content: it says what to test, never what to trust.