Operate / Service integrators

Operate with HTTP and OpenAPI

Execute versioned HTTP operations with exact schemas, idempotency, receipts, stable failures, and local verification.

proof object and mutation receiptv120 HTTP/OpenAPI interfaceComplete production checklist

Implementation rail · v120 HTTP/OpenAPI interface

Exact execution and operator checks

  1. 01

    Operator check

    Choose one declared operation and hold the artifact

    Use the generated OpenAPI record to bind exact method, path, request schema, response schema, auth model, stable errors, and idempotency field; separately hold the complete artifact bytes before transport.

    Substantive records: /reference/http-openapi · /reference/stable-errors

    Expected: The HTTP contract and stronger held input are exact before transport.

  2. 02

    Exact mechanic

    Verify the held bytes locally

    import { createReceizClient } from "@receiz/sdk";
    
    const encoded = process.env.RECEIZ_ARTIFACT_BASE64;
    if (!encoded) throw new Error("RECEIZ_ARTIFACT_BASE64 is required");
    const artifactBytes = Uint8Array.from(Buffer.from(encoded, "base64"));
    const receiz = createReceizClient();
    const verification = await receiz.verification.verifyArtifact(artifactBytes);
    if (verification.status !== "verified-artifact") throw new Error(verification.status);
    console.log(verification.status);
    Mechanic
    receiz.verification.verifyArtifact
    Authentication and account boundary
    Account-free local verification.
    Exact source
    node_modules/@receiz/sdk/dist/index.d.ts · SHA-256 3278d551808697d9936ffdf75931358c903bb0cc5a211191b611d4474895f6be

    Expected: Local SDK verification returns its exact status for the enclosing bytes before any HTTP comparison.

  3. 03

    Exact mechanic

    Compare the HTTP verification projection

    curl --fail-with-body --request POST "https://receiz.com/api/document-verify"   --form "file=@${RECEIZ_ARTIFACT_PATH:?RECEIZ_ARTIFACT_PATH is required}"
    Mechanic
    POST /api/document-verify
    Authentication and account boundary
    No Auth
    Exact source
    receiz-docs/generated/openapi-reference.json · SHA-256 2278eb9ab1dfcc90d61d4a6f9daac1bc55e17aeeab0d2d5d39228f88654bc20a

    Expected: The no-auth route returns the documented verification response or exact stable failure for comparison with the stronger local verdict.

  4. 04

    Operator check

    Qualify transport behavior

    Test wrong auth, invalid schema, oversized body, idempotency replay where applicable, stable error mapping, timeout, and local/network result disagreement.

    Substantive records: /reference/operations-receipts · /trust/conformance

    Expected: Transport failures remain distinct from proof verification.

Complete operating anatomy

Every boundary required to ship.

Solved outcome
An HTTP mutation returns a bounded receipt while the returned artifact remains independently verifiable outside the service.
Prerequisites
Hold the generated OpenAPI method and path, request and response schemas, exact auth model, credential custody, idempotency field where required, stable-error map, timeout policy, and local proof verifier.
Exact primitive
proof object and mutation receipt
Governing law
Operate with HTTP and OpenAPI is governed by interoperability-conformance: A passing execution confirms the checked cross-system proof invariants for the exact repository state exercised. canonical-artifact-verifier: The verifier classifies the supplied artifact. Embedded subpayloads and remote responses remain subordinate. authority-boundaries: Assigned control custody remains separated by recorded boundary.
Source-of-truth order
Receiz law → sealed artifact truth → deterministic proof object state → verified durable local or register truth → authenticated snapshot → server distribution, synchronization, indexing, and publication → database, session, observability, and interface projections.
Expected artifact, receipt, or state
A documented HTTP response containing the exact artifact or state receipt and stable failure classification.
Inspection
Inspect the status, response schema, operation identity, artifact digest, head, and idempotency result. Inspection exposes structure and receipt fields; inspection never establishes verification.
Independent verification
Independent verification for http-api: verify the returned artifact locally, then run the operation's named conformance suite. This establishes only the proof object and mutation receipt boundary named by the bound sources; The implementation rail remains beneath proof authority: v120 HTTP/OpenAPI interface.
Offline behavior
Held response artifacts verify offline. HTTP mutation requires reachability and never becomes the proof authority.
Identity and account boundary
Public Record Moment, Seal File, Verify, Export, and public proof reading are account-free. Identity is optional and adds continuity, custody, recovery, and governed private controls after proof admission.
Security boundary
Use TLS, scoped credentials, secret-safe logs, bounded bodies, stable idempotency keys, and explicit callback verification.
Conformance command
pnpm test:interoperability-conformance
Deployment checks
Qualify every used method and path against generated OpenAPI, correct auth and scopes, schema validation, stable errors, body limits, idempotency, retries, timeouts, receipt persistence, and independent local artifact verification.
Production checklist
Resolve the exact OpenAPI operation; test no auth, wrong auth, wrong scope, invalid schema, body limit, idempotency replay and conflict, timeout before and after response, stable errors, local verification, and result disagreement containment.
Rollback and containment
Containment for http-api: The mutation is rejected without proof authority change. Use the exact documented auth model and least-privilege scope. The integration fails closed. Preserve the bytes and reconcile against the exact OpenAPI revision. The held artifact result outranks transport projection. Contain the route, preserve both results, and investigate the source digest and bytes. Preserve every stronger held artifact and admitted state while the named boundary is corrected.

Fail closed

Mutation and failure matrix

F1

Authentication or required scope is absent or invalid.

Effect
The mutation is rejected without proof authority change.
Retry
Do not broaden credentials automatically.
Recovery
Use the exact documented auth model and least-privilege scope.
F2

Request or response violates the generated schema or stable-error contract.

Effect
The integration fails closed.
Retry
Do not parse unknown success shapes.
Recovery
Preserve the bytes and reconcile against the exact OpenAPI revision.
F3

Network response disagrees with local artifact verification.

Effect
The held artifact result outranks transport projection.
Retry
Do not accept the network claim.
Recovery
Contain the route, preserve both results, and investigate the source digest and bytes.

Exact authority

Claim-to-source bindings

  1. A passing execution confirms the checked cross-system proof invariants for the exact repository state exercised.

    scripts/test_interoperability_conformance.tsexecutable-conformance · SHA-256 c09d81f36305004f7ee02c40070b3c9cd64d8f5572ce12d211c022f3e75dbf4e
  2. The verifier classifies the supplied artifact. Embedded subpayloads and remote responses remain subordinate.

    packages/receiz-sdk/src/artifactVerification.tsimplementation-verifier · SHA-256 c10cdba92568fea273e1d9e7a3321083d52945378ab0cc83aee9720d44f0bba3
  3. Assigned control custody remains separated by recorded boundary.

    docs/governance/control-boundaries.v1.mdnormative-governance · SHA-256 da31636848c373e8d54e8d101885e15a9a29f7f8a734cf5fe675b7e7d5ec166e