{
  "counterfoil_receipt_version": "1",
  "kind": "ai-inference-attestation",
  "issued_ns": "2026-09-30T21:30:12.282766621+03:00",
  "claim": {
    "model_id": "ollama/llama3.2:latest",
    "output_label": "refused",
    "confidence": 1.0,
    "input_fingerprint": "sha3-256:9b8bde37645c70f084212841474497f9ee9bc80720af1d9363945b433fcec3d2",
    "inference_ts": null,
    "meta": {},
    "tool_calls": [
      {
        "seq": 0,
        "name": "shell.exec",
        "metadata_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308",
        "args_fingerprint": "sha3-256:016fa83dd3a2f59c0fc14dd3889bb1c9e2f5c4f48a9defd95078d2f0bea83429",
        "output_fingerprint": "sha3-256:1f97637a2eda6bb279bfd77f4f5654775308abe954c56f9fa577a803efbdd0dc",
        "server": "matrix-cr-shell (validate-only)",
        "ok": false
      }
    ],
    "model_fingerprint": "ollama:a80c4f17acd55265feec403c7aef86be0c25983ab279d83f3bcd3abbcb5b8b72",
    "envelope": {
      "prompt_fingerprint": "sha3-256:9b8bde37645c70f084212841474497f9ee9bc80720af1d9363945b433fcec3d2",
      "response_fingerprint": "sha3-256:a1f043b10fc78c84a30927bc6a8e8d24301239fa37b8eb41a1c0dbc8ddcebe6f",
      "params": {
        "temperature": 0,
        "seed": 7
      },
      "cost": {
        "input_tokens": 99,
        "output_tokens": 35
      },
      "security_verdicts": [
        {
          "seq": 0,
          "check": "command_gate",
          "rule_id": "git fetch",
          "verdict": "DENY",
          "detail_fingerprint": "sha3-256:79ed6dc66be614e06cf2ce89f8ec838ab2b0c1107d41bf74b9967cf00bd7feff"
        }
      ]
    }
  },
  "chain": [
    {
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1790793012280,
      "payload_hash": "7bf7bf998bea3b07232e4beb66c09524717ea6cf3506da1c76490729a2db7684",
      "prev_hash": "",
      "record_hash": "e4abf5cd51f3e7c46f52432fdcb0b5a346a7ab94a129eed340fcec8dc4612397",
      "sator_hmac": null
    },
    {
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1790793012280,
      "payload_hash": "aacffc790a956a2f55188410ca9f7b0968e781860bdcd25421a85f9b35d5f9b9",
      "prev_hash": "e4abf5cd51f3e7c46f52432fdcb0b5a346a7ab94a129eed340fcec8dc4612397",
      "record_hash": "e0540c4e45cdffb48530c5bd38397c607304765b3936790c1a2e386b3d01c255",
      "sator_hmac": null
    }
  ],
  "seed_anchor": "7bf7bf998bea3b07232e4beb66c09524717ea6cf3506da1c76490729a2db7684",
  "seal": {
    "alg": "ed25519",
    "public_key": "98f18cac17f6e1899daee286838abd5efe8694830c1501c875b4af423f1ce802",
    "key_fingerprint": "be19cba981ce0e02",
    "sealed_field": "chain[-1].record_hash",
    "sealed_value": "e0540c4e45cdffb48530c5bd38397c607304765b3936790c1a2e386b3d01c255",
    "signature": "cb5e404a0a58528d466c36276d732be1d439ed8cf6653652e97b9067077078632c1eb28def09128e133ba513dc7c6a6ac5c547843030f9bd9176287e3633170d"
  },
  "guarantees": {
    "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails.",
    "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
    "envelope_integrity": "inference envelope (prompt/response fingerprints, params, cost, security verdicts, drift) bound into the sealed claim; any edit fails verify. Attestation of the telemetry surface, not mutable observability logs.",
    "model_integrity": "model artifact hash bound into the sealed claim; a substituted or poisoned model binary fails claim-binding on verify.",
    "tool_integrity": "1 tool call(s) bound by args+output fingerprint into the sealed claim; any tampered tool output fails claim-binding on verify. Proves what the tools returned, not only that the model emitted text."
  },
  "verify_cmd": "python verify_counterfoil.py <receipt.json>"
}