ADR v1 / provisional

A decision, with an exact shape.

Inspect the fields and reproduce the envelope hashes. The same bytes feed ingestion, sealing and the independent verifier.

Download schema Download test vectors

Record fields

ADR input fields; tenant, record ID and sequence are assigned by the service.
Field	Type	Presence	Contract
`schema_version`	constant	Required	ADR v1. Schema evolution is additive only, so this constant does not move when optional fields are added.
`occurred_at`	string	Required	Caller-reported decision time, public; this is not trusted timestamp evidence.
`subject_id`	string	Required	Public opaque subject handle. Put identifying information only in private_fields.
`actor`	object	Required	Public actor class, pseudonymous opaque identifier and delegation chain.
`decision`	object	Required	Public decision action code, outcome category, options, autonomy and human-in-loop status; no explanatory text.
`model`	object	Optional	Optional public model provider, name code and version code.
`trace_id`	string	Optional	Optional public W3C trace identifier; nonzero, paired with span_id.
`span_id`	string	Optional	Optional public W3C span identifier; nonzero, paired with trace_id.
`policy_refs`	array	Optional	Optional public policy identifiers, represented as opaque tokens. The version of the governing policy goes in basis.policy_version.
`basis`	object	Optional	Optional public basis for the decision: input hashes, dated source citations and the governing policy version.
`undo_descriptor`	object	Optional	Optional public descriptor of what reverses this decision, and whether it is still reversible.
`outcome_link`	object	Optional	Optional public edge to the record that carries the outcome of this decision.
`retention_class`	string	Optional	Optional public tenant-defined retention class token. The retention sweeper selects on this token together with jurisdiction. Selection is dated by server-assigned acceptance time, a dry run is mandatory before any enforcement, and an operator hold outranks it.
`jurisdiction`	string	Optional	Optional public jurisdiction whose law governs this record. Coarse only.
`legal_hold_asserted`	object	Optional	Optional public caller assertion that a hold applies. The name says what it is: an assertion, not a control. The enforced hold is the operator-set subject hold, and the read-time hold_state on a receipt reports which of the two is in force.
`private_fields`	object	Required	Private JSON encrypted before persistence. Never present in a public envelope, log, receipt, or browser artifact. Source locators, operator names and approver identities belong here; source_locators keyed by citation_id is the documented place for a citation URL. The application rejects non-JSON values and nesting beyond 64 levels.

Byte-exact test vectors

Checking in this browser

Each result is recomputed locally with WebCrypto, then compared with the published digest. No service call is involved.

Vector	Canonical bytes	SHA-256	Result

An encrypted example record

This synthetic envelope contains ciphertext and public labels. Key material and private input are absent.

Loading the published example…

A matching hash shows that the envelope bytes are unchanged. It does not prove that a recorded decision was correct or that its inputs were true.

Follow the record, then check the proof.

Received means the request was acknowledged. Acknowledged is not durable. Durable means persisted in the configured store. Sealed means included in a signed root with a receipt.

Searchable-through: Searchable-through is not available. No search index is connected, and this watermark is never inferred from ledger state. It is a retrieval index position, not a durability state.

A missing record sequence is reported here, never skipped. When reconciliation finds a hole, the Received, Durable and Sealed watermarks stop at the last unbroken sequence.

Development signer means integrity under a published dev key and no independently trusted time.