v7.201.0

/swarm receipt --verify: machine-checkable internal-consistency check for gate receipts on any machine (#2970, Workstream J slot J23)

/swarm receipt --verify <bundle> re-checks every recorded hash (receipt
hash, artifact digests, and the bundled gate report's re-derived digest) in
an exported receipt bundle on any machine — including a fresh clone with no .swarm/
state — and exits nonzero on any mismatch with a typed failure:
corrupt_json, unsupported_format_version, schema_mismatch,
receipt_hash_mismatch, missing_artifact, digest_mismatch, or
path_escape. The verify path is a pure function of the bundle's two roots
(receipt.json + artifacts/): no .swarm/ reads, no config, no locks, zero
writes, and no child processes — which lets a reviewer mechanically reject
any bundle whose contents disagree with their own recorded hashes. It is
internal-consistency proof, not external attestation: a forger who
recomputes every digest consistently is only stopped by an out-of-band
capture-time anchor (a documented follow-up), and lazy edits that leave a
stale digest are caught because gate-report digests are RE-DERIVED from
the bundled bytes at verify time (FB-004). The same
classifier serves the receipt tool, so the tool's ok field and the
CLI's exit code can never disagree.

Path normalization and canonical hashing are imported from the emission
side (single source via toPortableRelativePath and the shared
canonicalizer), so a receipt emitted on Windows separators verifies
unchanged anywhere; receipt_hash covers the raw parsed object minus
receipt_hash itself, so an unknown added field flips verification
instead of being silently dropped.
The --verify arm accepts a bundle directory or a receipt.json path.

Documented limitations (inherited from the substrate): verify proves the
bundle is internally consistent and untampered relative to its recorded
hashes — it does not prove the cited gates ran against your clone's source
tree; an attached bundle contains the cited evidence artifacts even though
receipt JSON and verify output are digest-only; a future verifier that
re-executes cited commands would carry the full bounded-subprocess
obligation (AGENTS.md invariant 3) and needs its own issue.

---

Verification receipts substrate: portable, hash-backed gate records (#2968, Workstream J slot J22)

/swarm receipt <task|phase> <id> and the new receipt tool emit a portable
record of the durably recorded gate outcomes for a task or phase: bounded gate records
(id, outcome, responsible actor, evidence refs — digests only, never raw
command output), the snapshot hashes the gates were evaluated against
(plan-structure / policy / phase-evidence), and content-hashed artifact refs.
Receipts land under .swarm/evidence/receipts/ as canonical JSON
(format_version 1.0.0, receipt_hash computed over the raw parsed object minus receipt_hash itself)
plus rendered Markdown; --export writes a self-contained PR-attachable
bundle (receipt + Markdown + byte-copies of every cited artifact) under
.swarm/plan-export/receipt-<kind>-<id>-<shorthash>/. --verify ships in
this same release (see the swarm-receipt-verify fragment).

Behind the scenes: a phase's bounded gate report is durably captured at the
successful commit boundary (content-addressed write-once, fail-open to phase
completion — a receipt failure never fails a phase whose gates passed), the
derived receipts subtree is excluded from the phase-evidence snapshot so
emitting receipts can never mutate the identity the gates enforce, and the
new durable stream is registered in the observability retention registry
(mixed privacy; newest-8 per unit; staged atomic export; exported plan-export
bundles are reaped at close, completing the row's keyspace-bound claim).

Documented limitations: hash-only integrity is spoofable by a determined
local actor or by a model willing to recompute every digest consistently
— receipts stop lazy falsification (persisted gate reports are RE-DERIVED
from their bytes at build and verify time, FB-004), and full integrity
against a recomputing forger needs an out-of-band capture-time anchor
(documented follow-up); receipts provide integrity against the model, not
the user's own machine; absent command/exit_code/output_digest fields mean no
durable producer recorded them (omitted, never reconstructed); path
normalization is byte-exact forward-slashing without case-folding; there is
no historical backfill — phases completed before this feature have no
captured report and emit a clear error.