Receipt types.
Every custody-relevant event in a Déjà vault produces a tamper-evident, hash-chained receipt. This document specifies the ten receipt types defined by DSR/1.0 — their triggers, schemas, and relationships. It is the canonical reference for Heads of Risk, CISOs, security architects, and audit-firm technologists — including teams at firms such as KPMG, Deloitte, EY, PwC, BDO, Grant Thornton, and independent auditors — verifying receipts under SOC 2 Type II, ISO 27001, NYDFS Part 500, DORA, or SR 11-7 frameworks.
A Déjà receipt is a structured, cryptographically verifiable record of something that happened in a vault — an incident attributed, a fix verified, an auditor verifying a chain, a configuration changed. Core and lifecycle receipts (R1, R2, RV, RE, RG) carry an Ed25519 asymmetric signature; exception receipts carry a SHA-256 content hash for tamper-evidence. Receipts are the product's atomic unit of evidence. They are not events, logs, or records; they are cryptographic custody artifacts, and they behave as such. Verifiable offline via dsr-verifier-cli (pre-release · public release Q3 2026) by any party with a copy of the signed bundle.
The taxonomy is partitioned into three families: core receipts that document the happy path of an incident lifecycle (R1, R2); exception receipts that document the unhappy paths most systems silently drop (R0, R1-L, R1-N, R2-F, R2-R); and lifecycle receipts that record actions on the custody infrastructure itself (RV, RE, RG). The partition matters because a chain of custody with gaps is worse than no chain at all — Déjà records the failures too. Regulated firms operating under continuous-evidence obligations cannot afford silent gaps.
Every receipt carries the same base envelope: type, version, vault_id, actor, timestamp, prior_hash (for chained types), and signature. The type-specific fields documented below extend this envelope.
The taxonomy.
Ten types, grouped by function. Core receipts account for approximately 95% of issuance volume in typical vaults; exception and lifecycle receipts are rare but structurally essential.
The DSR/1.0 specification defines ten receipt types as semantic categories. The current Déjà codebase materializes them across ten dedicated database receipt tables:
sde_cross_service_receipts— covers the attribution surface (R1), distinguished at the data level via aconfidencefield with valuesHIGH_CONFIDENCE_DEDUCTION(CCS ≥ 0.90) andSTANDARD_DEDUCTION(0.80 ≤ CCS < 0.90).sde_resolution_receipts— covers the resolution surface (R2, R2-F, R2-R), distinguished viagates_passedandgate_evaluated_atfields rather than as separate receipt rows.
The dsr-verifier-cli projects the database representation back into the canonical DSR/1.0 receipt format. Audit firms verifying receipts offline see the spec-correct view: a single canonical R-subtype envelope per event, signed and chain-verifiable, regardless of how the database stores the underlying record. This is by design — the verifier is the contract surface; the database is an implementation detail.
Lifecycle receipts (RV, RE, RG) are fully implemented with dedicated tables (sde_verification_receipts, sde_engagement_receipts, sde_governance_receipts) and active issuers. Verification (RV), evidence-bundle export (RE), and governance configuration changes (RG) are issued as receipt-grade cryptographically signed artifacts in the same pipeline as core receipts. The full subtype documentation below describes the canonical DSR/1.0 envelope and materialization details explicitly per subtype.
Attribution Receipt.
Issued when Déjà's Schema Deduction Engine produces a causal attribution with Causal Confidence Score ≥ 0.80. R1 is the first receipt in a custody chain — every downstream receipt (resolution, verification, export) references it.
CCS ≥ 0.80.HIGH_CONFIDENCE_DEDUCTION (CCS ≥ 0.90) or STANDARD_DEDUCTION (0.80 ≤ CCS < 0.90).DD-INC-84729).RedisConnectionRefused).acme/payments#412.[0.0, 1.0].deterministic_sde for Schema Deduction Engine.{
"type": "R1",
"version": "DSR/1.0",
"receipt_id": "r_01hwxak9vz",
"vault_id": "vault_01hx2k",
"incident_id": "DD-INC-84729",
"service_zone": "payments-checkout",
"error_type": "RedisConnectionRefused",
"causal_pr": "acme/payments#412",
"ccs_score": 0.9200,
"signals": {
"code_change_match": 0.94,
"temporal_proximity": 0.89,
"field_overlap": 0.91,
"stack_trace_match": 0.98
},
"prior_match": null,
"author": "m.rodriguez@acme.com",
"method": "deterministic_sde",
"timestamp": "2026-04-19T14:02:33.441Z",
"signature": "a7f3c8d2e94b1052f6a38c7d9e2b4f01..."
}chained_from = hash(R1).prior_match references an earlier R1 with matching fingerprint — institutional memory.Resolution Receipt.
Issued when all five operational gates pass within the observation window following a deployed fix. R2 closes the chain opened by R1 — chained by hash. The presence of an R2 is how a regulator distinguishes "incident happened" from "incident resolved and verified."
error_rate_normalized, infrastructure_green, feature_flags_stable, observation_window, file_rate_baseline.causal_pr.passed_at timestamps.Ingestion Receipt.
Issued the instant an incident signal enters Déjà, before any attribution work. Proves the signal was received intact at timestamp X regardless of what happens next. Most organizations never need R0; regulators who want to prove Déjà didn't selectively ingest certain incidents will require it.
r0.enabled = true on vault (Enterprise tier default: false).datadog:ubs-prod).Low-Confidence Attribution.
Issued when candidate PRs are identified but the highest CCS falls in the low-confidence range (0.60 ≤ CCS < 0.80) — below attribution threshold but above the floor for non-trivial signal. Explicitly marks the attribution as ambiguous and carries the top three candidate PRs with individual scores. Requires human review; can be upgraded to R1 by a human confirmation (issues a chained RG receipt).
0.60 ≤ CCS < 0.80 — below attribution threshold but above the low-confidence floor, with non-trivial candidate signal."ambiguous".{ pr, ccs_score, signals } per entry.true for R1-L.No-Attribution Receipt.
Issued when Déjà examines the incident and finds no causal attribution above the inferred-attribution cap. Most incident tooling silently discards these. Déjà signs them — a custody chain with gaps is worse than no chain at all. The "we looked and came up empty" receipt is what makes the system trustable.
no_recent_prs, insufficient_field_overlap, no_stack_trace, etc.Resolution-Failed Receipt.
Issued when a fix is deployed but one or more gates fail within the observation window. The incident remains in open-chain state. R2-F is what turns "we tried and it didn't work" from a missing data point into a tamper-evident custody artifact.
passed/failed status and failure reason for failed gates.true — R2-F does not close the chain.Resolution-Reopened Receipt.
Issued when a previously-closed R2 chain reopens because the same fingerprint recurs within a defined window (default 30 days). Chains to the original R1 AND the new R1. Institutional memory at the receipt level — "this didn't actually stay fixed."
Verification Receipt.
Issued when an external party — auditor, regulator, internal SOC — verifies one or more receipts via the open DSR/1.0 verifier. This is the receipt that proves an auditor looked and the chain held. Zero-knowledge of content; proof-of-verification only.
valid / invalid / partial.dsr-verifier-cli, dsr-verifier-web, or third-party.Export / Engagement Receipt.
Issued when an evidence bundle is exported or an audit engagement is signed. Proves what was shared, with whom, and when. RE is the bridge receipt between internal custody and external sharing — an RE with a defined recipient is itself an audit engagement.
view, verify, export, download_raw.Governance Receipt.
Issued when any configuration of the vault's custody infrastructure changes: retention policy, integration added or removed, team access granted, routing rule edited, zone merged. RG is custody-of-the-custody-system. The receipt that proves the rules themselves haven't been tampered with.
Maintained by Déjà · Patents: 18/668,178 + 19/430,349 + CIP March 2026 + SDE Provisional March 2026