Prove Apply, Verify, and Restore as three separate steps.
Bring back a small data-only receipt from Dream Skin, HeiGe, or CodeDrobe. This workbench checks the app version, upstream commit, package digest, six required surfaces, persistence choice, and Restore result without uploading the JSON.
Runtime receipt
What this receipt can and cannot prove
A complete receipt is a reviewable record from one user-run environment. It does not automatically earn the public Verified badge, certify an installer, or prove every platform. Site-owned verification still requires retained screenshots, logs, device/version identity, native-control checks, current source evidence, and a repeatable Restore run.
Keep the receipt data-only
Do not add file paths, user names, email addresses, project names, prompts, tool arguments, API keys, process dumps, screenshots, or Codex task content. The validator rejects unknown fields so runtimes cannot silently smuggle unrelated device data into the artifact.