The DAGR first-run proof pack

1. What happened

The governed journey

The producer records the linkage it captured as a single string:

proposed_action -> native_action -> native_result_or_non_execution -> receipt_chain

Every value below is read from the committed bytes. Nothing in this table is inferred, and nothing is a conclusion reached here.

Non-execution is the producer's observed fact at the governed boundary, scoped to that boundary, and it is not a GARPedia verdict. It says the native action behind this one governed tool call did not run in this capture. It does not establish anything about conduct outside that boundary, and it certifies no compliance posture.

2. The artifacts

The JSON receipts

The JSON receipts are the artifacts. ARCS owns the SRS envelope, its schema, and its named conformance profiles; all three receipts were issued against srs.mcp.sdk_enforcement v0.1.

Admitted call — admission receipt

{
  "actor_ref": "actor:dagr:first-run",
  "argument_digest": "sha256:b59f7468f81b784a26f2501a172032a66c6570c8b49a775c66168937c064a601",
  "artifact_classes_covered": [
    "tool_call_admission"
  ],
  "artifact_classes_excluded": [
    "raw_prompt",
    "raw_output",
    "raw_tool_arguments",
    "raw_tool_result"
  ],
  "attestation_limits": [
    "The receipt attests only to governance conditions at the named admission boundary."
  ],
  "boundary_id": "boundary:dagr:first-run-harness",
  "boundary_type": "mcp_tool_call",
  "disposition": "admitted",
  "extensions": {
    "mcp": {
      "binding_version": "direct-harness.v0.1"
    }
  },
  "issued_at": "2026-01-01T00:00:00Z",
  "issuer_id": "issuer:dagr:first-run-capture",
  "logical_call_id": "call:dagr:first-run:admitted",
  "policy_pack_id": "policy:dagr:first-run",
  "policy_pack_version": "v0.1",
  "profile_id": "srs.mcp.sdk_enforcement",
  "profile_version": "v0.1",
  "protocol_binding": "mcp",
  "receipt_id": "urn:srs:receipt:admission:first-run-capture-0001",
  "receipt_kind": "admission",
  "receipt_signature": {
    "algorithm": "Ed25519",
    "canonicalization": "RFC8785-JCS",
    "key_id": "issuer.dagr.first-run-capture/receipt-signing/fixed",
    "signature": "DQCiFmb3B0bEiG8I_jB-1RFhMeiQHS0g0bQKaw02EOrlPiUxTnB6DOBmyKBIbOqAQxenuSwVyP3xpnWAwX2jCg"
  },
  "receipt_type": "sdk_enforcement",
  "receipt_version": "srs.core.v5.1",
  "requested_tool_name": "frontdoor.native_action",
  "retention_class_applied": "hash_only",
  "runtime_instance_id": "runtime:dagr:first-run",
  "subject_ref": "call:dagr:first-run:admitted",
  "subject_ref_origin": "derived_from_request",
  "tool_resolution_status": "not_observed"
}

Admitted call — outcome receipt

{
  "actor_ref": "actor:dagr:first-run",
  "admission_receipt_ref": "urn:srs:receipt:admission:first-run-capture-0001",
  "artifact_classes_covered": [
    "tool_call_outcome"
  ],
  "artifact_classes_excluded": [
    "raw_prompt",
    "raw_output",
    "raw_tool_arguments",
    "raw_tool_result"
  ],
  "attestation_limits": [
    "The receipt attests only to governance conditions at the named admission boundary.",
    "The receipt establishes the request, admission disposition, and semantic result returned at the configured boundary. It does not independently establish that the underlying tool body executed for this invocation, because middleware such as caches may satisfy a call without handler execution."
  ],
  "boundary_id": "boundary:dagr:first-run-harness",
  "boundary_type": "mcp_tool_call",
  "extensions": {
    "mcp": {
      "binding_version": "direct-harness.v0.1"
    }
  },
  "issued_at": "2026-01-01T00:00:01Z",
  "issuer_id": "issuer:dagr:first-run-capture",
  "logical_call_id": "call:dagr:first-run:admitted",
  "outcome": "result_returned",
  "profile_id": "srs.mcp.sdk_enforcement",
  "profile_version": "v0.1",
  "protocol_binding": "mcp",
  "receipt_id": "urn:srs:receipt:outcome:first-run-capture-0001",
  "receipt_kind": "outcome",
  "receipt_signature": {
    "algorithm": "Ed25519",
    "canonicalization": "RFC8785-JCS",
    "key_id": "issuer.dagr.first-run-capture/receipt-signing/fixed",
    "signature": "-pHmDKDtEW6eWr-XbQfDV5fOz6Qf0nziaw-ZuAl5QDFBl1hHH2S-bSSDIbgEDON_M9M_lDri1M535FNqQSVeCg"
  },
  "receipt_type": "sdk_enforcement",
  "receipt_version": "srs.core.v5.1",
  "result_digest": "sha256:59908744d93162740dc50b240fdaf8d18ef6b611a69feba5cbde8ef4b8f1f02e",
  "retention_class_applied": "hash_only",
  "runtime_instance_id": "runtime:dagr:first-run",
  "subject_ref": "call:dagr:first-run:admitted",
  "subject_ref_origin": "derived_from_request"
}

Refused call — admission receipt

A refused admission receipt is a valid, signature-valid receipt: authentic evidence that a refusal occurred, not a failed receipt. There is no matching outcome receipt, because no outcome was reached.

{
  "actor_ref": "actor:dagr:first-run",
  "argument_digest": "sha256:b59f7468f81b784a26f2501a172032a66c6570c8b49a775c66168937c064a601",
  "artifact_classes_covered": [
    "tool_call_admission"
  ],
  "artifact_classes_excluded": [
    "raw_prompt",
    "raw_output",
    "raw_tool_arguments",
    "raw_tool_result"
  ],
  "attestation_limits": [
    "The receipt attests only to governance conditions at the named admission boundary."
  ],
  "boundary_id": "boundary:dagr:first-run-harness",
  "boundary_type": "mcp_tool_call",
  "disposition": "refused",
  "extensions": {
    "mcp": {
      "binding_version": "direct-harness.v0.1"
    }
  },
  "issued_at": "2026-01-01T00:00:02Z",
  "issuer_id": "issuer:dagr:first-run-capture",
  "logical_call_id": "call:dagr:first-run:refused",
  "policy_pack_id": "policy:dagr:first-run",
  "policy_pack_version": "v0.1",
  "profile_id": "srs.mcp.sdk_enforcement",
  "profile_version": "v0.1",
  "protocol_binding": "mcp",
  "reason_code": "policy_refused",
  "receipt_id": "urn:srs:receipt:admission:first-run-capture-0002",
  "receipt_kind": "admission",
  "receipt_signature": {
    "algorithm": "Ed25519",
    "canonicalization": "RFC8785-JCS",
    "key_id": "issuer.dagr.first-run-capture/receipt-signing/fixed",
    "signature": "z0oJjiSH-Zor3pr1wvjYIsq-zIC5AP27ub6PpufTnxya4N9F2ulNrtAHrWw46M1x7t5J7s0XflhWoLwpqd49Ag"
  },
  "receipt_type": "sdk_enforcement",
  "receipt_version": "srs.core.v5.1",
  "requested_tool_name": "frontdoor.native_action",
  "retention_class_applied": "hash_only",
  "runtime_instance_id": "runtime:dagr:first-run",
  "subject_ref": "call:dagr:first-run:refused",
  "subject_ref_origin": "derived_from_request",
  "tool_resolution_status": "not_observed"
}

The producer's observed execution record

This file is the producer's own output under schema dagr.first_run.side_effects.v0.1. Its booleans were observed by the harness, not authored here and not derived from the receipts.

{
  "arcs_verify_command": "for receipt in dagr-first-run-output/urn_srs_receipt_*.json; do arcs-verify \"$receipt\" --keyring dagr-first-run-output/issuer-keys.json --profile srs.mcp.sdk_enforcement.v0.1; done",
  "capture_mode": true,
  "mfd_frontdoor_01_linkage": "proposed_action -> native_action -> native_result_or_non_execution -> receipt_chain",
  "quickstart_commands": [
    "python -m venv .venv",
    "source .venv/bin/activate  # Windows: .venv\\Scripts\\activate",
    "python -m pip install dagr-mcp",
    "dagr-mcp first-run --output ./dagr-first-run-output"
  ],
  "scenarios": {
    "admitted": {
      "admission_receipt_ref": "urn:srs:receipt:admission:first-run-capture-0001",
      "failure_reason": null,
      "governed_ok": true,
      "inner_invocation_count_after": 1,
      "inner_invocation_count_before": 0,
      "native_action_executed": true,
      "outcome_receipt_ref": "urn:srs:receipt:outcome:first-run-capture-0001",
      "policy_decision": "allow"
    },
    "refused": {
      "admission_receipt_ref": "urn:srs:receipt:admission:first-run-capture-0002",
      "failure_reason": "denied",
      "governed_ok": false,
      "inner_invocation_count_after": 1,
      "inner_invocation_count_before": 1,
      "native_action_executed": false,
      "outcome_receipt_ref": null,
      "policy_decision": "deny"
    }
  },
  "schema": "dagr.first_run.side_effects.v0.1"
}

3. Where it came from

Fixture provenance

Two producers are pinned separately, because the evidence and its verification were not produced by the same step. GARPedia produced neither; it copied both. Nothing is fetched from either repository at build or run time.

Producer — the receipts and the observed record

Repository

thelaplage/dagr-mcp

Commit

362f7a565a3813924892b0fb7da046b63b1b080a

Command

dagr-mcp first-run --capture --output ./dagr-first-run-output

Signing identity

issuer:dagr:first-run-capture

Determinism

Capture mode uses a fixed signing identity and an injected clock, so the emitted bytes are byte-identical across runs. Re-running the command above at the pinned commit reproduces all five producer files below, digest for digest.

public/garpedia/examples/dagr-first-run/urn_srs_receipt_admission_first-run-capture-0001.jsonsha256:f364df8d438a75f8d50f09ba36ec53ad44a28608b0c2175f7fac4a13c5adb214

Admission receipt for the admitted call (disposition: admitted).

public/garpedia/examples/dagr-first-run/urn_srs_receipt_outcome_first-run-capture-0001.jsonsha256:f4828bb2598be2ace699b240b030e9bbb7fb9249fe8075ffff440b612e4e44c6

Outcome receipt for the admitted call (outcome: result_returned).

public/garpedia/examples/dagr-first-run/urn_srs_receipt_admission_first-run-capture-0002.jsonsha256:3e9f9e0268bb0770c1b3232b9dd4cb69f58600b604efca2fe0e3f4b49e7be5ee

Admission receipt for the refused call (disposition: refused).

public/garpedia/examples/dagr-first-run/side_effects.jsonsha256:a8758dc7644e0aa27acf37d6b02ceb3671e0218628d389ae24ade279a1efa9eb

The producer's observed execution record for both calls (schema dagr.first_run.side_effects.v0.1).

public/garpedia/examples/dagr-first-run/issuer-keys.jsonsha256:edea1389bd2d7a861a4a0f61f81f3bb68197cd184f3363278a35b993598064a4

The trust bundle the verifier was given: public keys only, no secret material.

Verifier — the verification reports

Repository

thelaplage/arcs-verify

Commit

09b22a8691327c439052acf6515e152e9af78e28

Pack path

packs/srs.mcp.sdk_enforcement/v0.1/implementation/dagr-mcp-first-run/

Report contract

srs.dagr_verification_report.v0.2

Authorship

The reports are the verifier's own output bytes. No verdict on this page was hand-authored, and no verdict is recomputed at build or run time.

public/garpedia/examples/dagr-first-run/verification-report-admission-first-run-capture-0001.jsonsha256:3d029670a12ab8bf45dcf4e22cb6c5ef5707475397eaa25984466501af33b803

Verification report for the admitted admission receipt.

public/garpedia/examples/dagr-first-run/verification-report-outcome-first-run-capture-0001.jsonsha256:7035eb14bfc269b6c8bfca854db02f2902e36d665f305f537e2fdb318336e06d

Verification report for the admitted outcome receipt.

public/garpedia/examples/dagr-first-run/verification-report-admission-first-run-capture-0002.jsonsha256:42b3f6141ac76b2e7c9798df58641c2948b17b8a74874e5cbdc88c03b877aecf

Verification report for the refused admission receipt.

4. How to read them

Plain-language reading

Every row below is a field the artifact actually carries. These reading aids add no field the JSON does not already have, and they claim nothing the JSON does not say. The JSON stays authoritative.

The refused admission receipt

receipt_kindadmission

An admission receipt records an admission decision made at the boundary before any governed call could proceed. It does not establish that the handler actually ran.

dispositionrefused

Refused means the checked governance conditions were not satisfied, so admission was denied at the boundary. A refused receipt is a valid, signature-valid receipt — it is authentic evidence that a refusal occurred, not a failed or invalid receipt.

reason_codepolicy_refused

The recorded reason for the refusal, carried as data rather than left implicit.

requested_tool_namefrontdoor.native_action

The governed action that was proposed. The same tool name appears on the admitted call, so the two scenarios differ in the decision, not in what was asked for.

argument_digestsha256:b59f7468f81b784a26f2501a172032a66c6570c8b49a775c66168937c064a601

A hash of the tool arguments. The receipt references and hashes the arguments; it does not carry them.

artifact_classes_excluded["raw_prompt","raw_output","raw_tool_arguments","raw_tool_result"]

The raw content classes this receipt explicitly does not carry or attest to.

attestation_limits["The receipt attests only to governance conditions at the named admission boundary."]

The receipt's own stated scope limit, carried as data. This receipt attests only to governance conditions at the named admission boundary.

receipt_signature.key_idissuer.dagr.first-run-capture/receipt-signing/fixed

The signing key identifier. Whether this key is trusted for this issuer is a verifier-side question, answered by the trust bundle the verifier was given — not by this page.

The admitted outcome receipt

receipt_kindoutcome

An outcome receipt records what the boundary observed after an admitted call returned.

outcomeresult_returned

The semantic result observed at the configured boundary: a result was returned.

admission_receipt_refurn:srs:receipt:admission:first-run-capture-0001

The admission receipt this outcome is bound to. This reference is the receipt chain for the admitted call.

result_digestsha256:59908744d93162740dc50b240fdaf8d18ef6b611a69feba5cbde8ef4b8f1f02e

A hash of the returned result. The receipt references the result; it does not carry it.

attestation_limits["The receipt attests only to governance conditions at the named admission boundary.","The receipt establishes the request, admission disposition, and semantic result returned at the configured boundary. It does not independently establish that the underlying tool body executed for this invocation, because middleware such as caches may satisfy a call without handler execution."]

The receipt states its own limit: it establishes the request, the admission disposition, and the semantic result returned at the configured boundary. It does not independently establish that the underlying tool body executed for this invocation. That the native action executed is the producer's separately observed fact in side_effects.json.

5. What an independent verifier found

The verification report

Independent verification is owned by ARCS Verify, a separate tool. It reads serialized receipts, a serialized trust bundle, and a pinned schema, and recomputes every property from those bytes. It imports no producer code. The three reports below are its output, copied here unchanged. This page displays them; it did not produce them and does not itself establish their authenticity.

Read the third column carefully. The refused receipt passes every verdict, with no failure codes. Refusal is not a verification failure: the receipt is authentic evidence that a refusal occurred. Enforcement is not shown by a receipt failing to verify — that would be a category error. It is shown by two separate things: the refused receipt verifying as authentic, and the producer's observed record showing the native action did not run.

Reading the report fields

report_contract_idsrs.dagr_verification_report.v0.2

The verification-report contract these bytes were emitted against. @garpedia/contracts carries this family as an imported, release-closed contract; GARPedia did not define it.

receipt_artifact_hashd17647725459f5c247e298e9d2d1fbfef69f4d1ee025057f75a2d81030e98888

sha256 of the RFC8785-JCS canonicalization of the receipt the verifier read. It binds the report to specific receipt bytes.

verifier_repository / verifier_commithttps://github.com/thelaplage/arcs-verify @ 09b22a8691327c439052acf6515e152e9af78e28

Which verifier, at which exact commit, produced this report. Never a mutable ref.

trust_bundle_digest50338ce550647e4a2327704c7a01e92a1ed778c95edeba82babd7a064ee1fc80

A digest of the trust bundle the verifier was given. Issuer trust is a property of that bundle, not of this page.

verdicts8 boolean fields

The eight ARCS verdicts: schema_digest, envelope, profile, raw_content_exclusion, signature_valid, issuer_key_resolved, issuer_key_trusted, attestation_limits_present.

chain_statusnot_applicable

Reported separately from the eight verdicts, never a ninth verdict. not_applicable for a standalone receipt.

subject_ref_origin_disclosedderived_from_request

Disclosure of how the receipt's subject reference was arrived at. It is a disclosure, never a verdict: it neither upgrades nor downgrades any verdict above.

failure_codes[]

Empty for this report. Note what this means for the refused receipt: refusal is not a verification failure. The receipt recording the refusal verifies cleanly.

6. How to check it yourself — the verify command

The verify command

This is the real invocation syntax, shown as reference. This page does not run it. The first form prints the verdicts; the second emits the structured reports rendered above.

for receipt in dagr-first-run-output/urn_srs_receipt_*.json; do
  arcs-verify "$receipt" \
    --keyring dagr-first-run-output/issuer-keys.json \
    --profile srs.mcp.sdk_enforcement.v0.1
done

for receipt in urn_srs_receipt_*.json; do
  arcs-verify dagr-report-v0-2 "$receipt" \
    --keyring issuer-keys.json \
    --profile srs.mcp.sdk_enforcement.v0.1 \
    --verifier-commit 09b22a8691327c439052acf6515e152e9af78e28
done

This page does not run arcs-verify. The reports below are output bytes produced by a separate arcs-verify invocation at the pinned commit, copied here unchanged. A reader who wants to reproduce them needs their own arcs-verify install and the trust bundle committed alongside the receipts.