v0.5.0 - Deployment/version receipts

v0.5.0 - Deployment/version receipts

This release adds the lowest-friction X-facing demo: signed deployment/version receipts.

The idea: X can publish a receipt proving that rollout R used algorithm commit C, model artifact root M, config hash H, and policy bundle P during time window T. Anyone can verify the receipt offline. No user data, ranking output, or private infrastructure details need to be disclosed.

New commands

npm install
npm run deployment-demo
npx @veritasacta/verify examples/deployment-version/deployment.receipt.json \
  --jwks examples/deployment-version/deployment.jwks
npx @veritasacta/verify examples/deployment-version/feed-session-certificate.receipt.json \
  --jwks examples/deployment-version/deployment.jwks

Included fixtures

• deployment.receipt.json: public production-version-style receipt for algorithm/model/config/policy bundle metadata.
• feed-session-certificate.receipt.json: user-facing certificate showing what a Premium user could see without exposing user features or ranked output.
• deployment.jwks: public key for both demo receipts.

Claim boundary

This is a demo receipt derived from the real Phoenix fixture in this repo. It is not a claim about production X. A real deployment would need X, or an authorized deployment observer, to hold the signing key and define the rollout metadata.