Docs

Receipts

A receipt is a signed statement about one merge. You can verify it without Sigbound.

What is in one

The goal and the attempt, by number and title.
The evidence: Sigbound AI's verdict and read, every done-means line and how it was proven, the checks.
The decision: who approved and when; who wrote it and through which harness.
The merge: the branch, the commit main moved from and to; the gate's engine version.
The seal: the signing key's fingerprint and the ledger sequence.
Optionally a bill of materials for the landed tree, in SPDX and CycloneDX, by digest.

SIGBOUND

merge receipt · seq 62

2026-09-08T22:32:37.328249Z

Goal

goal#7 · README: a one-line pointer to the Troubleshooting section under Play

attempt7.1 · README: point Play readers to Troubleshooting

Evidence

Sigbound AIpass · read of 97cbe5f

done means1 of 1 pass, read by Sigbound AI

checks3 green · ci / build · ci / test · ci / typecheck

Decision

approved bySurya Koritala · Sep 8, 2026, 6:32 PM

Merge

written bySigbound CLI, as Surya Koritala

verified bythe gate · engine 2.4.0

branchmain

moved2f7ad3e → 53a1332

Seal

gateverified

ledgerseq 62

SEALED · j86E-8EcfYYa

seals this commit, this evidence, this approver.
verify offline — this page never checks signatures.

The format

A DSSE envelope over an in-toto statement, signed with an Ed25519 key that belongs to the gate. The public key is published per repository, by fingerprint. The receipt page decodes; it never verifies. The check belongs to you.

Getting one

Every landing row in the ledger opens its receipt page. The envelope itself comes from the API: its address is the landing sequence and the landing instant, both shown on the page, and ?format=slsa returns the same landing as SLSA provenance:

curl -H 'Sigbound-Version: 2026-08-14' -H 'Authorization: Bearer $SIGBOUND_TOKEN' \
  'https://api.sigbound.com/orgs/<space>/repos/<repo>/landings/62/receipt?at=2026-09-08T22:32:37.328249Z' \
  > sigbound-landing-62.dsse.json
# the same landing as SLSA provenance: add &format=slsa
# the signing key by fingerprint: /orgs/<space>/repos/<repo>/landing-keys/SHA256:<fingerprint>

Verifying one

The CLI fetches the signing key by fingerprint from the repository and checks the signature locally. With --key it uses a key document you pinned earlier and touches no network at all.

sigbound verify sigbound-landing-62.dsse.json --repo <space>/<repo>
sigbound-landing-62.dsse.json: signed by SHA256:j86E-8EcfYYa… · main 53a1332 · seq 62 at 2026-09-08T22:32:37Z · verified

# fully offline, against a pinned key document
sigbound verify sigbound-landing-62.dsse.json --key landing-key.json

Any DSSE-aware tool verifies the same envelope: the payload type is application/vnd.in-toto+json and the signature covers DSSE's pre-authentication encoding of the exact payload bytes.