feat(e13-wsb): CaptureReceipt — universal bind-purpose-before-f() primitive

[mdheller]

Epoch E13 / WS-B — CaptureReceipt

Lands the keystone capture-time receipt as a universal primitive. It generalizes TwinAttestation.envelope.authorization (already on main in schemas/TwinAttestation.json) into a domain-agnostic object that binds a declared purpose + authorization to a datum before the transform f() that consumes it runs.

Why bind at capture

The reidentification-economy result: purpose is provably unrecoverable from the signal — I(purpose; Q) = 0 between a purpose bit and a quasi-identifier-bearing signal Q. Purpose cannot be inferred post-hoc, so it must be sealed at capture or it is gone. CaptureReceipt is that seal.

Contract

• declaredPurpose, authorizationProof, boundBeforeTransform: true (all required) gate a named transform, optionally bound against a contextRef (reference-at-ingest / VRF).
• Fail-closeddisposition ∈ {admitted, refused, inert}: no valid purpose+proof ⇒ cannot be admitted.
• reversibilityFloorBits ties WS-B to WS-D (ReversibilityDistance).

Machine-checked invariants (beyond schema)

1. id starts with urn:srcos:capture-receipt:
2. boundBeforeTransform is exactly true
3. missing/empty declaredPurpose OR authorizationProof ⇒ disposition must be refused/inert
4. disposition in the closed enum

Files

• schemas/CaptureReceipt.json
• examples/capture_receipt.json (admitted) · examples/capture_receipt_refused.json (refused)
• tools/validate_capture_receipt_examples.py (wired into make validate)
• docs/adr/0019-capture-receipt.md

Verification

$ python3 tools/validate_capture_receipt_examples.py
OK examples/capture_receipt.json
OK examples/capture_receipt_refused.json
All CaptureReceipt examples valid (schema + invariants).
$ python3 scripts/check_duplicate_schema_ids.py
OK: 353 unique schema $id values

🤖 Generated with Claude Code