# TrustCheck and Governance Receipts v0.1

Status: authenticated test preview. Schema version: `2026-08-29`.

This vertical slice records a proposed Registry Claim publication as an Action Intent, resolves its existing Alpha IDs, evaluates current Authority through deterministic TrustCheck policy, accepts the result reported by the source system, and atomically creates a private Governance Receipt.

It does **not** mutate the public Registry. It does not expose private TrustChecks or Receipts through public discovery. The receipt digest is test-only and is not a production issuer signature.

## Transaction

1. `POST /v1/action-intents`
2. `POST /v1/trust-checks`
3. On `require_approval`, an entitled approver records the Approval Decision with `POST /v1/action-intents/{actionIntentId}/approvals`. The approver is the authenticated account, which must not be the account that created the Intent (`403 approver_is_requester`) and must hold the entitlement the TrustCheck's `required_approvals` demand (`registry_steward` requires the Alpha administrator `governance:approve` permission; `403 approver_not_entitled` otherwise). The decision is bound to the Intent payload digest and TrustCheck policy version and expires after fifteen minutes.
4. The source system proceeds only when the unexpired decision is `allow`, or `require_approval` with a recorded `approved` decision.
5. `POST /v1/action-intents/{actionIntentId}/result`
6. `GET /v1/receipts/{receiptId}`

Every call requires an authenticated WorkOS session or supported Auth0 bearer token. Actor and operator are bound to that authenticated Alpha Account. Responses are private, non-cacheable, rate-limitable, correlated by `X-Request-ID`, and use a stable `error` envelope.

## Copyable test request

```bash
curl https://www.alpha.ac/v1/action-intents \
  -H 'Content-Type: application/json' \
  -b "$ALPHA_SESSION_COOKIE" \
  -d '{
    "schema_version":"2026-08-29",
    "request_id":"00000000-0000-4000-8000-000000000010",
    "idempotency_key":"registry-claim-test-0001",
    "environment":"test",
    "actor":{"alpha_id":"alpha:account:self","type":"alpha_account"},
    "agent":{
      "provider":{"alpha_id":"alpha:company:alpha-governance-group-pbc","type":"provider"},
      "product":{"alpha_id":"alpha:agent-product:trustcheck-developer-example","type":"agent_product"},
      "deployment":{"alpha_id":"alpha:agent-deployment:trustcheck-test","type":"agent_deployment"},
      "use_case":{"alpha_id":"alpha:agent-use-case:registry-claim-test","type":"agent_use_case"},
      "workflow":"Registry Claim publication test"
    },
    "operator":{"alpha_id":"alpha:account:self","type":"alpha_account"},
    "principal":{"alpha_id":"alpha:person:steven-wolfe-pereira","type":"person"},
    "sponsor":{"alpha_id":"alpha:person:steven-wolfe-pereira","type":"person"},
    "organization":{"alpha_id":"alpha:company:alpha-governance-group-pbc","type":"organization"},
    "proposed_action":{"type":"registry.claim.publish","description":"Stage a test Claim.","claim":{"predicate":"governance.test_status","value":"fixture","assertion_class":"source_fact"}},
    "purpose":"Verify the governed transaction loop.",
    "affected_subjects":[{"alpha_id":"alpha:person:steven-wolfe-pereira","type":"person"}],
    "requested_authority":["registry.claim.publish"],
    "expected_systems":["Alpha Governance Registry test harness"],
    "expected_tools":["Alpha Platform API"],
    "expected_data":["public Registry identity"],
    "anticipated_impact":{"level":"low","description":"Test records only."},
    "jurisdiction":"US",
    "requested_time":"2026-08-29T20:00:00Z",
    "policy_references":["trustcheck.registry-claim.test.v0.1"],
    "control_references":["alpha.control.registry-test-mode.v0.1"],
    "evidence_references":["alpha:evidence:trustcheck-test-fixture-v01"],
    "metadata":{"fixture":true}
  }'
```

TrustCheck returns `allow`, `deny`, `require_approval`, or `insufficient_evidence`, with reason codes, `rule_references` naming the policy/control behind each reason code, authority, evidence, conditions, approvals, expiration, versions, and limitations. It never returns an opaque trust score. An Eval may inform policy but cannot authorize the action.

The result call must reference the unexpired allowed TrustCheck, or a `require_approval` TrustCheck with a valid approved Approval Decision. It records the source system's report and creates the Receipt in one database transaction. Reusing an idempotency key with different content fails closed. Request bodies above 32 KiB are rejected with `413`; Receipt inputs keep Alpha IDs only.

## Production gap

Live mode, delegated approver roles beyond the Alpha administrator entitlement, webhook delivery, durable distributed rate limiting, organization-level entitlement policy, production JOSE signing, key rotation, and actual Registry publication remain disabled. A production release must replace test fixture Authority with governed grants, use a production signing key through Alpha's existing JWKS infrastructure, and separately approve the Registry mutation adapter.

## Rollback

Remove the five `/v1` routes and revert the additive migrations before production data exists. After data exists, preserve the append-only audit and receipt rows, revoke service access, and ship a forward migration; do not destructively rewrite receipts.