File formats

One rule underlies most of them: canonical JSON is keys sorted, no spaces, every non-ASCII character escaped, numbers written as JavaScript writes them; a digest is the SHA-256 of those bytes. Three implementations agree on it: the browser's, the server's, and the census tools'. The one exception is the Desk saved record, which digests its pretty-printed form so the file you hold is byte-exact.

The Desk receipt (kind: habitat-receipt, version: desk/2)

{ "kind": "habitat-receipt", "version": "desk/2",
  "file": { "name", "kind": "agent session log" | "Habitat receipt" | "file", "bytes", "sha256" },
  "checked_at": "<ISO time>",
  "computed": "in the browser that made this file; nothing was sent",
  "signed": null | <signed block>,
  "results": [ { "check": "<Type>: <question>", "state": "clear" | "found" | "failed", "result": "<text>", "limit"?: "<text>" } ],
  "context": { "kind", "scope", "id" }, "prev": "<digest of the previous receipt about the same file>" }

Written by Record’s ↓ on a run. A census report is this format with more fields in the body. It never carries the checked file's contents.

The signed block (habitat-signed-v1)

"signed": { "version": "habitat-signed-v1", "alg": "Ed25519",
            "kind": "habitat-receipt" | "habitat-desk-record" | "habitat-gem",
            "did": "did:habitat:<32 hex>", "public_key": "<base64, raw 32 bytes>",
            "signed_at": "<ISO, the signer's clock>", "digest": "<64 hex>", "sig": "<base64>",
            "grant": { "grant": {...}, "signature": "<base64>" } | null }

The message signed is four lines joined by newlines: habitat-signed-v1, the kind, the digest, the time. The signer ID is did:habitat: plus the first 32 hex of the SHA-256 of the raw public key. The grant, when present, is the Foundation's signed statement that this ID is a member and what it opens; anyone can check it against the Foundation's members key, which Desk carries.

The Desk saved record (desk_version: "0.1-alpha")

The whole desk: the card, the store's fingerprint, how it was read, every paragraph with its text and its reads (each read with its positions, including the sentence embedding), the notes, the room as read at save, the author's ID and name, a chain link to the previous save, a digest over the record as pretty-printed with one-space indent, and the signed block. File name desk-record-<card>-<stamp>.json. It holds your words.

The Record file (kind: habitat-receipt-desk)

Written by Save in Record’s foot, named receipt-desk-<date><time>.json: the time it was saved and, for each file added, its name, size and every check run. No file contents. Unsigned.

Remarks on a gem (kind: habitat-gem-remarks)

Written by Save while a gem is open, named desk-gem-<card>-remarks.json: the gem's digest and the remarks kept on it. The gem itself is unchanged.

The gem (kind: habitat-gem, gem_version: "0.3-path")

The card, the store's fingerprint, how it was read, when it was given, for each chosen paragraph the ids of the passages beside it, the path of acts (each with its id, its place, its time, its 17 numbers, and how it was classified), the totals, the line "leaves_out": "the words, notes, and every paragraph not chosen", a digest over the canonical JSON without digest and signed, and the signed block. File name desk-gem-<card>-<stamp>.json. The server, when a gem is given to a Gem-Space, re-verifies every one of those parts.

The census report

census_session-logs.json: the time, the tool and its SHA-256, the logs folder, the rule source, the totals, the counts by month and by who, the split rule, the scope rule, every write outside the folder, every re-issue with its seconds, every log's fingerprint, and the line about what is not counted. A Markdown twin beside it.

The anchor

A statement in the in-toto form: the path, its SHA-256, the kind, the case, the edition, the issuer habitat.ooo, and a note. Serialized canonically, signed by the Foundation's receipts key as a DSSE envelope, posted to Rekor. The anchor file keeps the statement, the envelope, and the log's answer: its uuid, integrated time, log index, the inclusion proof and the signed entry timestamp. Append-only; a new anchor is a new file with a new date.

The anchors index

/receipts/anchors/index.json: the Foundation's public key path and its fingerprint, the log's key path, and one entry per anchored object with name, path, SHA-256, anchor file, log index and time. A path beginning with / is a site path; a bare name is a kit under the site's kit folder. The build gate reads this index and refuses any served object whose bytes differ from it.

The digests files

/digests.json is the index anchored on 16 October 2026 and served unchanged. /digests-e2.json carries later kit editions, anchored on 20 October. Each case: page, status, kit file, kit SHA-256, the digest the kit's verdict rests on (v3_fsum), and a history of earlier kits with dated notes.

The published receipt

Case, question, domain, register, status, verdict, the published digest (geometry_digest_v3), the kit's SHA-256, the page it was made for, and a note that may qualify its own number. Its SHA-256 is the anchored subject.