Add execution receipt schema v1 for published results

[MaxGhenis]

Fixes #570

What this adds

policyengine.provenance.receipt.ExecutionReceipt (schema v1) is a strict, immutable, JSON round-trippable record of exactly what produced a UK result. It is the contract the UK Budget dashboard (W5) uses for per-measure receipts, and the scorecard (W6) binds to it. Both need it by 14 October.

Field	Contents
wrapper, model, core	Versions of policyengine, policyengine-uk and policyengine-core, read from the installed distributions. The schema fixes the names as consts. A wheel SHA-256 appears only with evidence: either wheel_paths= (the builder checks the wheel's members against its RECORD one to one, then the installed files against the wheel), or the installer's PEP 610 archive hash.
data	Release, build, the build-time model version, dataset name, URI and revision, and the SHA-256 hashed from the bytes simulated.
certification_status, certificate	certified only when the bundle certificate covers the installed model and core, those dataset bytes and name, and the running wrapper. Otherwise the receipt is uncertified. The certificate digest is RFC 8785 over data_releases.uk.
reform, baseline	Both required. Each is current_law or a digest of {representation, payload}, never normalized across representations. A Scenario with a module-level simulation_modifier is bound by code_revision (see below).
fiscal_year	uk_fiscal_year: year Y is the fiscal year starting 6 April Y (2027-28). It is a const in v1.
outputs_sha256, runtime	An optional output digest, and the runtime context, which is part of no digest.

Also added:

• provenance.canonical (RFC 8785);
• provenance.wheels;
• the builders build_execution_receipt and build_execution_receipt_for_microsimulation;
• verify_certificate;
• the JSON Schema shipped in the wheel, with x-policyengine-rules and x-policyengine-digests;
• docs/receipts.md.

Invariants (each tested)

1. No false certification. A certificate's model, core, dataset digest and wrapper equal what ran. The builder certifies only when the bundle covers all of them.
2. Verification is exact. verify_certificate(receipt, bundle) rebuilds the certificate and the data identity from the bundle record, using the builder's own derivation. Any consistent forgery of a certified member is reported, even one that keeps the genuine record digest. Tests cover each of 16 single-field forgeries, Hypothesis-generated combinations, and a builder/verifier differential over bundle edits. certificate_source is the producer's statement, not evidence.
3. Digest separation. The execution identity depends only on wrapper, model, core, data and certificate content. The receipt digest adds reform, baseline, years and outputs, never runtime context or labels (Hypothesis).
4. Strict, canonical digests.
   • Nothing is stringified: sets, Decimal, arrays, NaN, datetimes, longdouble and deep nesting are refused with ReceiptError.
   • Member order and null-versus-omitted don't change a digest.
   • Output matches the rfc8785 package (differential) and the W6 golden fixtures byte for byte.
5. A modifier digest names only code that ran.
   • The digest covers the function's source, its module's source and its defaults, plus code_revision with a full commit sha.
   • It is identical across checkout paths and on Python 3.11–3.14.
   • The module's source as read must compile to the loaded code for every module-scope function, and module-scope literal constants must still hold their values. Edits after import and constants reassigned at run time are refused.
   • Closures, lambdas, methods, partials and non-Scenario objects are refused.
6. Wheel evidence is real. A junk zip carrying a copied RECORD fails. Only launchers named in entry_points.txt are exempt, and stray .pyc or INSTALLER files fail. The real policyengine-core 3.33.0 install verifies: 199 members and 199 files.
7. Model and schema agree (differential): both accept every generated valid receipt and reject the same malformed ones.

Review history

Independent adversarial review by an Opus 5.5 agent; the Codex lanes were unavailable. Each round executed reproductions and mutation runs.

• Round 1: 13 findings, fixed in 2d4cb9a.
• Round 2: 9 findings, fixed in 7df93cf. These covered certificate forgery, path-dependent modifier digests, wheel launchers and contents, caller-supplied metadata, non-Scenario inputs, unbound defaults, longdouble and recursion, and schema strictness.
• Round 3: all nine round-2 findings were confirmed fixed. Its four new items are fixed in 5ec9bbf: module edits after import, seven mutation gaps, refusal messages and exception types.
• Round 4: in progress at 402900a.

Breaking against earlier heads (v1 is unreleased):

• metadata_module= is removed;
• release_manifest_sha256 is removed from data;
• the fiscal convention is UK-only;
• the package-role models are ModelIdentity and CoreIdentity.

Re-vendor from this head.

Checks run locally

• 202 receipt, wheel and canonical tests pass; the full suite passes (1,450 passed at 7df93cf).
• ruff (CI version) and mypy on the new modules are clean.
• generate_receipt_schemas.py --check passes, and the schema output is identical on pydantic 2.10.6 and 2.14.0.

axiom: n/a: provenance/infrastructure contract, no policy change.

🤖 Generated with Claude Code