[sinkog]

What

A Rust and Go verifier for the materialization receipt (docs/RECEIPT-SCHEMA.md), cross-checked through a shared differential corpus. It verifies a receipt; it does not produce one. No new repository, no producer, no change to the receipt format, D-018, the materialization scope boundary or Relay.

verify_receipt / receipt.Verify establish structural and content consistency only (details and non-claims in docs/RECEIPT-VERIFIER.md).

Checked

• All 15 required top-level fields, correct types, closed layout, sole wrapper materialization. Typed Receipt, DefaultEvidence, DerivedEvidence in both languages.
• receipt_schema_version is the integer 1 (1.0 is rejected).
• Every digest is sha256: + 64 lowercase hex. Base64 / bare hex are refused; only an equal-bytes re-spelling by the producer is a valid conversion.
• applied_defaults / derived_values strictly ascending by .path; inputs a strictly ascending, deduplicated set; rule, path and value-digest forms.
• output_digest == materialized_object_digest; input_digest == A7 digest of the canonical form of the processed authored input (a value, not raw source bytes; no YAML reader assumed).
• Defaulted / derived object fields and the receipt's evidence lists match exactly, with each value_digest checked.

Evidence boundary

• MaterializedObject keys are not turned into $.config.* paths by guessing. Evidence is verified only through an explicit PathBinding supplied by the caller. A missing binding is E_RECEIPT_UNBOUND (fail closed), never partial success.
• Both lists empty and no defaulted/derived field in the object verifies fully without a binding.
• derived_values[].inputs is checked for form and order only. No rule requires an input path to exist in the object (a vector pins that).
• Not established: that a default or derivation ran, that rule/inputs describe what happened, or who produced the receipt. Metadata identifiers are claims; no signature or release-origin check. engine_identity names the implementation that materialized the data, not this verifier.

Tests and evidence

• conformance/differential/receipt/: 35 vectors (3 accepted, 32 rejected), including changed input digest, changed output digest, missing field, unsupported version, version not an integer, unsorted / duplicated evidence and inputs, missing path binding, partial binding, wrong provenance, changed value digests. Rejections pin code, rule and location.
• Digests were computed by an independent script over the documented canonical form, cross-checked against the already-pinned materialized_object_digest vector first. Neither engine generated them.
• A second test per language alters one field of each accepted receipt and requires a rejection. I also checked by hand that a wrong expectation fails in both languages (Go needs -count=1 for that: its test cache does not track files outside the module).
• Unit tests in both languages. Existing corpus unchanged.

Local: cargo fmt --check, clippy -D warnings, cargo test --workspace (debug and release), gofmt, go vet, go test -race ./... all green.

Not merging

Per instruction, this is not to be merged automatically.