papers/lux-trust-kernel/sections/06-receipt-anchoring.tex

\section{Receipt Anchoring}
\label{sec:receipts}
%% ===================================================================

Every trust-relevant state transition in the Lux trust kernel produces a
\emph{receipt}: a compact, self-contained proof that the transition occurred.

\begin{definition}[Trust Receipt]\label{def:receipt}
A trust receipt $\mathcal{R}$ is a tuple:
\[
    \mathcal{R} = (\mathsf{chain}, \mathsf{block}, \mathsf{txHash},
                   \mathsf{type}, \mathsf{subject}, \mathsf{digest},
                   \mathsf{sig})
\]
where $\mathsf{chain} \in \{\text{K}, \text{T}, \text{M}, \text{I}\}$ identifies
the originating chain, $\mathsf{block}$ and $\mathsf{txHash}$ identify the
transaction, $\mathsf{type}$ is the receipt type (Table~\ref{tab:receipts}),
$\mathsf{subject}$ is the affected DID, $\mathsf{digest}$ is the SHA-256 hash
of the receipt payload, and $\mathsf{sig}$ is a BLS aggregate signature from the
chain's validator set.
\end{definition}

\begin{table}[h]
\centering
\caption{Trust receipt types by originating chain.}
\label{tab:receipts}
\begin{tabular}{llp{6cm}}
\toprule
\textbf{Chain} & \textbf{Receipt Type} & \textbf{Meaning} \\
\midrule
K & \textsc{KeyRegistered} & New key record created \\
K & \textsc{KeyRotated} & Key rotated to successor \\
K & \textsc{CapGranted} & Capability delegated \\
K & \textsc{CapRevoked} & Capability revoked \\
T & \textsc{QuorumApproved} & Threshold vote passed \\
T & \textsc{QuorumRejected} & Threshold vote failed \\
M & \textsc{SignatureProduced} & Threshold signature emitted \\
I & \textsc{DIDRegistered} & DID document created \\
I & \textsc{CredentialIssued} & Credential hash anchored \\
I & \textsc{CredentialRevoked} & Credential revoked \\
\bottomrule
\end{tabular}
\end{table}

\subsection{Capsule Audit Trails}

A capsule maintains a local log of operations (encrypt, decrypt, share, revoke).
For each operation, the capsule computes a digest and submits it as an
\textsc{AnchorTx} to the appropriate chain. The chain includes the digest in a
receipt. The capsule stores the receipt locally alongside the operation log entry.

\begin{theorem}[Audit Completeness]\label{thm:audit}
If a capsule faithfully anchors every operation and the trust kernel satisfies
BFT safety (Section~\ref{sec:security}), then for any operation $o$ in the
capsule's log, there exists a finalized receipt $\mathcal{R}$ on-chain such that
$\mathcal{R}.\mathsf{digest} = H(o)$.
\end{theorem}

The on-chain receipt stores only the digest---never the operation payload. An
auditor can verify completeness by comparing the capsule's local log against the
receipt chain, without the chain ever learning the contents of the operations.

%% ===================================================================