Open format · schema v1

Receipt format

A Tab Checkout receipt is a strict JSON outcome ledger paired with a separately hashed snapshot. It explains what was recommended, what the user approved, what actually closed, and what remained uncertain.

Why a receipt exists

URLs alone are not enough. A useful recovery artifact also needs titles, order, reasoning, citations, unresolved risks, explicit overrides, actual browser outcomes, and honest restore limits. The receipt separates a proposed close from evidence that it occurred.

Non-schema field map

This synthetic excerpt explains the boundary without pretending to be importable JSON for the strict schema. The executable definition lives in packages/receipts/src/portable.ts.

synthetic field map · not importablecopy

{
  "_note": "Synthetic non-schema field map; not importable as receipt v1",
  "receiptContains": {
    "goalAndResult": true,
    "reviewedTabDecisions": true,
    "boundedCitedQuotes": true,
    "closeOutcomeSets": ["requested", "actuallyClosed", "alreadyGone", "failed", "uncertain"],
    "restoreOutcomeSets": ["restored", "failed"],
    "privacyAndRelayProvenance": true,
    "snapshotIdAndHash": true
  },
  "pairedSnapshotContains": {
    "orderedFullUrls": true,
    "tabAndGroupAppearance": true,
    "captureMetadataAndLimitations": true
  },
  "integrityMeans": "internal consistency, not authorship or tamper evidence"
}

Core objects

Snapshot

A separate tab-checkout.snapshot/1 document holds the ordered recovery boundary, ephemeral browser IDs, URLs, tab/group appearance, capture disclosures, risks, limitations, and checksum.

Reviewed tab manifest

Every tab has a role, risk level, suggested decision, user decision, explicit-override flag, and human-readable reason. Models cannot authorize risky closure; an override is recorded as a user act.

Privacy receipt

Capture mode, relay attempt/dispatch/result, provider/model provenance, evidence retention, and permission-revocation result describe the actual data path—not merely the final analyzer used.

Outcome sets

Requested, actually closed, already gone, failed, and uncertain are separate. Restore likewise records success and failure. A disappeared tab is never credited as closed by Tab Checkout.

Integrity

Canonical JSON recursively sorts object keys and omits undefined values before hashing. The receipt stores:

snapshotHash — the recomputed SHA-256 checksum of the paired snapshot payload.
payloadHash — SHA-256 of the complete receipt payload, excluding the integrity object itself.

What hashes checkThey establish whether the content agrees with its embedded integrity values and catch corruption or edits whose values were not recomputed. Because an editor can recompute them, they are not tamper evidence and do not prove who created a receipt, source truth, trusted time, or an independently authenticated browser action. Digital signatures are not part of schema v1.

Restore semantics

Restore should reopen the stored URLs in receipt order and report failures. It should never claim to reproduce volatile page state. The following are outside the v1 receipt contract:

Form fields, editor buffers, carts, and POST bodies
Session cookies, authentication, and incognito context
Media position, calls, uploads, and downloads
Guaranteed scroll position, SPA route state, and page mutations
Content that changed or disappeared after checkout

Compatibility policy

Readers must reject unsupported future schema versions rather than guessing. New optional behavior requires a schema revision when it changes validation or safety meaning. Version 1 uses strict objects: unknown fields are validation errors.