Identity
Authenticated actor, module digest, service identity and request ID.
VERIFICATION / RECORDS
Execution evidence should be attributable and checkable.
OSR aims to bind authorization decisions and runtime outcomes to verifiable records without exposing secrets.
Proposed receipt schema
Authorization
Permission scope, requested operation/resource, grant ID and policy revision.
Result
Execution status, bounded output metadata, timestamps and error classification.
Integrity
Cryptographic signature, controlled key lifecycle and external checkpoint association.
Limits of a signature
A hash chain by itself does not make evidence tamper-proof. A signature only establishes that a key attested to particular bytes and does not independently prove that the host was secure or the operation was authorized. Durable records and external validation are required for stronger assurance.