# TrustCheck and Governance Receipts v0.1

Status: authenticated test preview. Schema version: `2026-08-29`.

This vertical slice records a proposed Registry Claim publication as an Action Intent, resolves its existing Alpha IDs, evaluates current Authority through deterministic TrustCheck policy, accepts the result reported by the source system, and atomically creates a private Governance Receipt.

It does **not** mutate the public Registry. It does not expose private TrustChecks or Receipts through public discovery. The receipt digest is test-only and is not a production issuer signature.

## Transaction

1. `POST /v1/action-intents`
2. `POST /v1/trust-checks`
3. The source system proceeds only when the unexpired decision is `allow`.
4. `POST /v1/action-intents/{actionIntentId}/result`
5. `GET /v1/receipts/{receiptId}`

Every call requires an authenticated WorkOS session or supported Auth0 bearer token. Actor and operator are bound to that authenticated Alpha Account. Responses are private, non-cacheable, rate-limitable, correlated by `X-Request-ID`, and use a stable `error` envelope.

## Copyable test request

```bash
curl https://www.alpha.ac/v1/action-intents \
  -H 'Content-Type: application/json' \
  -b "$ALPHA_SESSION_COOKIE" \
  -d '{
    "schema_version":"2026-08-29",
    "request_id":"00000000-0000-4000-8000-000000000010",
    "idempotency_key":"registry-claim-test-0001",
    "environment":"test",
    "actor":{"alpha_id":"alpha:account:self","type":"alpha_account"},
    "agent":{
      "provider":{"alpha_id":"alpha:company:alpha-governance-group-pbc","type":"provider"},
      "product":{"alpha_id":"alpha:agent-product:trustcheck-developer-example","type":"agent_product"},
      "deployment":{"alpha_id":"alpha:agent-deployment:trustcheck-test","type":"agent_deployment"},
      "use_case":{"alpha_id":"alpha:agent-use-case:registry-claim-test","type":"agent_use_case"},
      "workflow":"Registry Claim publication test"
    },
    "operator":{"alpha_id":"alpha:account:self","type":"alpha_account"},
    "principal":{"alpha_id":"alpha:person:steven-wolfe-pereira","type":"person"},
    "sponsor":{"alpha_id":"alpha:person:steven-wolfe-pereira","type":"person"},
    "organization":{"alpha_id":"alpha:company:alpha-governance-group-pbc","type":"organization"},
    "proposed_action":{"type":"registry.claim.publish","description":"Stage a test Claim.","claim":{"predicate":"governance.test_status","value":"fixture","assertion_class":"source_fact"}},
    "purpose":"Verify the governed transaction loop.",
    "affected_subjects":[{"alpha_id":"alpha:person:steven-wolfe-pereira","type":"person"}],
    "requested_authority":["registry.claim.publish"],
    "expected_systems":["Alpha Governance Registry test harness"],
    "expected_tools":["Alpha Platform API"],
    "expected_data":["public Registry identity"],
    "anticipated_impact":{"level":"low","description":"Test records only."},
    "jurisdiction":"US",
    "requested_time":"2026-08-29T20:00:00Z",
    "policy_references":["trustcheck.registry-claim.test.v0.1"],
    "control_references":["alpha.control.registry-test-mode.v0.1"],
    "evidence_references":["alpha:evidence:trustcheck-test-fixture-v01"],
    "metadata":{"fixture":true}
  }'
```

TrustCheck returns `allow`, `deny`, `require_approval`, or `insufficient_evidence`, with reason codes, authority, evidence, conditions, approvals, expiration, versions, and limitations. It never returns an opaque trust score. An Eval may inform policy but cannot authorize the action.

The result call must reference the unexpired allowed TrustCheck. It records the source system's report and creates the Receipt in one database transaction. Reusing an idempotency key with different content fails closed.

## Production gap

Live mode, approval execution, webhook delivery, durable distributed rate limiting, organization-level entitlement policy, production JOSE signing, key rotation, and actual Registry publication remain disabled. A production release must replace test fixture Authority with governed grants, use a production signing key through Alpha's existing JWKS infrastructure, and separately approve the Registry mutation adapter.

## Rollback

Remove the four `/v1` routes and revert the additive migration before production data exists. After data exists, preserve the append-only audit and receipt rows, revoke service access, and ship a forward migration; do not destructively rewrite receipts.