# HonestMX Proof Receipts

Every completed verification has a stable receipt at `GET /v1/verifications/{id}/receipt`. The response contains the exact JSON payload bytes as unpadded base64url plus an Ed25519 signature. Public keys are published at `/.well-known/honestmx-receipt-keys.json` and old public keys remain discoverable while retained receipts use them.

The signed payload freezes the verdict, reason, billing decision, observation time, service/policy versions, MX fingerprint, provider kind, SMTP evidence, TLS state and catch-all-control provenance. It contains a service-keyed pseudonymous recipient binding, not the raw address. An authenticated caller can compare an address with that binding using `POST /v1/verifications/{id}/receipt/subject`.

## Python verification example

```python
import base64
import json
import urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

def b64url(value: str) -> bytes:
    return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))

receipt = json.load(open("receipt.json", encoding="utf-8"))
keys = json.load(urllib.request.urlopen(
    "https://honestmx.com/.well-known/honestmx-receipt-keys.json"
))
key = next(item for item in keys["keys"] if item["key_id"] == receipt["key_id"])
payload = b64url(receipt["payload"])
signature = b64url(receipt["signature"])
Ed25519PublicKey.from_public_bytes(b64url(key["public_key"])).verify(signature, payload)
print(json.loads(payload))
```

Verify the signature over the decoded `payload` bytes exactly. Do not parse and reserialize the JSON before verification.

## What a receipt proves

A valid signature proves that the named HonestMX key signed those exact historical payload bytes. It does not prove inbox placement, future deliverability, message acceptance from a particular sender, or human readership. SMTP systems can change after `checked_at`; use `source`, `checked_at`, `cache_expires_at`, `control_source` and `control_observed_at` when deciding whether evidence is recent enough.