@receiz/mcp-server

Production MCP server for agents building and verifying Receiz apps through the canonical @receiz/sdk rails.

Current package: @receiz/[email protected]. Release coordinate: v127.0.0. Constitutional ruleset: 127.0.0.

V127 — Reality-Grade Infrastructure

V127 aligns the SDK, compiler, MCP and AI packages with complete source custody, first-seal ownership, deterministic coordinates and verified append continuity. The public function catalog covers 678 callable exports across the main, compiler, testing, React, offline sealing, local subject host and offline KaiSigil entry points. MCP capability reporting includes this catalog and the complete 425-method client inventory; 330 explicit tools retain their SDK authority boundaries.

V127 ships offline file tools, receiz_offline_kai_proof, and source-bound local subject tools. The Node host uses packaged KaiSigil resources without network access or enrollment; temporal mutations consume full coordinates against the retained causal head. File sealing runs offline after explicit device enrollment. Configure identity/source custody and preserve the full sealed portable history using the SDK local subject runtime guide and offline sealing guide. Historical HTTP tools retain their signatures but fail before requests or mutation previews unless an explicit compatibility host is configured; see historical HTTP compatibility.

Preserved V125 economy contracts

Sealed Reality Becomes Spendable Value. Economic authority follows proof, not institution. V125 adds thirteen current MCP tools above the complete historical inventory. Three admit lawful actions and derive their deterministic Settlement. Ten mirror the complete client.value.edge lifecycle: explicit Settlement/Reserve planning, participant inspection, portable transition verification, exact local commit preparation, committed recovery packaging, and independent sender/receiver confirmation.

MCP is not authority. Law and action proof bytes never enter model arguments. The model supplies an opaque proofReference, receives an exact confirmation digest before mutation, and the trusted host resolves the sealed bytes only after confirmation. Programmatic runtimes pass resolveV125ProofReference to createReceizMcpRuntime. The stdio executable loads the same seam from RECEIZ_V125_PROOF_HOST_MODULE; that ESM module must export:

export async function resolveReceizV125ProofReference(reference) {
  return { exactBytes, filename, mimeType };
}

KKSv1.0 is the single temporal authority exposed through MCP. receiz_v124_kai_now returns only a coordinate candidate from the canonical SDK's local Genesis/frequency computation; the response is not authority until the existing KaiSigil proof binds it and the canonical SDK admits the full coordinate in its causal context. receiz_sealed_kai_moment accepts only the complete KaiSigil-bound coordinate carried by a verified sealed proof object; a bare pulse string is rejected. Neither tool accepts createdAt as proof input or consults a network, server, or database clock. Chronos is descriptive projection only, and MCP never becomes temporal authority.

All MCP derivation follows the exact forward-only authority flow source -> evidence -> relationship -> permissible inference -> representation. The actual sealed proof object is terminal authority. MCP input references, responses, plans, receipts, server rows, and projections are downstream mechanics; none can reconstruct, replace, or outrank the proof object. An append advances the same proof object's exact predecessor-bound history head and never creates a parallel object authority.

The enclosing artifact is verified before its lawful-action payload is admitted, and the payload's embedded portable execution-authority proof is reverified before its subject head, causal parents, commitments, witness, and Kai coordinates are accepted. The caller cannot submit a completion verdict, Phi, a multiplier, a bonus, a backfill, or an institutional exemption. Current value is deterministically recomputed from sealed Kai coordinates, and custody moves one stable spendable Settlement membership without duplication. Reserve remains the legacy funding rail.

The v125 edge tools require a runtime-pinned application audience and reuse the existing V124 trusted-material host. Plans and portable recovery objects may persist behind opaque refs. Verified transition sets, prepared commit sets, and SDK-issued committed transitions remain same-runtime-custodied because serializing them would destroy the stronger SDK custody boundary. Settlement/Reserve send and receive resolve the exact recovery, independently reverify it at the user edge, and return only safe coordinates. They never call a server to create, approve, price, or redefine the transaction. receiz_capabilities exposes the complete ordered 425-method public SDK client inventory, all 330 explicit MCP adapters, and all six v125 capability families so SDK, MCP, and AI drift is observable and release-locked. Three callable artifact-recovery methods retain their historical classification; history remains present without being presented as a new v125 default.

Historical V124 — Reality Becomes Infrastructure

The Production Runtime for Verified Civilization. The V124 MCP package identity binds agents to the same constitutional registry and 53-operation application compatibility matrix as the SDK and AI Skills. The existing V123-named MCP tools remain stable protocol identifiers for canonical world planning, exact-head namespaces, explicit-consent proof authority, distinct Phi Settlement and Reserve, and lookup-before-retry recovery. V124 does not rename them or create an MCP authority layer.

Sealed proof objects and exact authenticated heads remain authority. MCP confirmations, server responses, sessions, database rows, SDK projections, and model output remain subordinate coordination. Public V124 transport calls fail closed unless the response is authenticated and bound to the exact request and stronger proof/head evidence; package identity alone does not establish operational deployment.

Exact V124 production-runtime tools

The package exposes these 26 direct adapters to the canonical V124 SDK. Application ID and audience are pinned once by the MCP runtime; a tool call cannot select or replace them.

• Clock and challenge: receiz_v124_kai_now, receiz_v124_proof_authority_challenge_create
• Exactly-once execution: receiz_v124_execution_plan_atomic_operation, receiz_v124_execution_stage, receiz_v124_execution_stage_prepared, receiz_v124_execution_execute, receiz_v124_execution_resolve, receiz_v124_execution_resolve_by_idempotency, receiz_v124_execution_cancel
• Authority-session runtime: receiz_v124_runtime_authority_session_open, receiz_v124_runtime_authority_session_refresh, receiz_v124_runtime_authority_session_close, receiz_v124_runtime_qualify
• Verified domain continuity: receiz_v124_domain_verified_additions, receiz_v124_domain_verified_replay, receiz_v124_domain_verified_checkpoint, receiz_v124_domain_verified_private_additions, receiz_v124_domain_replay_proof_object_export, receiz_v124_domain_replay_proof_object_restore
• Source-carried replay, conversation, and material: receiz_source_carried_replay_open, receiz_conversation_source_family_open, receiz_conversation_epoch_grants_plan, receiz_material_source_parts_open
• Namespace, recipient, and source coordination: receiz_v124_subject_namespaces_resolve, receiz_v124_identity_public_recipient_resolve, receiz_v124_source_publish_sealed

Two timeless local tools complete portable proof presentation without creating a new authority layer:

• receiz_material_url_open verifies the enclosing artifact carried by a content-bearing URL, reconstructs its exact native payload locally, classifies image/audio/video/PDF/text/binary playback, and returns the canonical Receiz proof URL. Fully inline rma2 capsules open without transport lookup. Segmented rmc1 and streaming rmc2 heads resolve their complete committed family; rmc2/rma3/raw projects the raw artifact rather than invoking the compressed RMA2 decoder. A public-head bound never truncates proof bytes. The presentation URL may be on a developer-owned domain; transport never becomes proof authority.
• receiz_sealed_kai_moment verifies and projects the complete KaiSigil-bound KKSv1.0 creation coordinate carried by the enclosing proof object. A numeric pulse or micro-pulse without the KaiSigil proof is rejected. It never reads createdAt, device time, browser time, process uptime, session state, network state, or server state. Use it for existing identity/proof glyphs; do not substitute the non-authoritative coordinate candidate returned by receiz_v124_kai_now.

The ref contract is exact:

• Planning returns planRef; staging consumes planRef, while prepared staging also consumes transitionSetRef, then returns handleRef.
• Execute and cancel consume the exact MCP-held handleRef and a sessionRef.
• Session open consumes identityArtifactRef, subjectSourceArtifactRef, and signedChallengeRef; refresh consumes sessionRef, identityArtifactRef, and signedChallengeRef. Open/refresh return a local sessionRef and, when host persistence is configured, persistedSessionRef.
• Private additions return only safe coordinates plus privateAdditionsRef; the exact viewer-filtered encrypted result remains in trusted host custody.
• Replay export returns exact base64url portable candidate bytes. The candidate is not sealed and is not authority. Canonical Record/Seal must produce a separately verified artifact before restore consumes sealedReplayProofObjectRef.
• Sealed-source publication consumes sealedSourceArtifactRef; replay-segment/checkpoint publication also consumes sessionRef.

All ref-backed mutation previews bind content digests of the exact resolved snapshots, not only ref strings. handleRef, sessionRef, plans, confirmations, and private-addition refs remain non-authoritative coordination beneath sealed proof objects and authenticated heads.

Trusted V124 material host

Identity artifacts, signed challenges, sealed source artifacts, persisted authority sessions, private additions, and portable transition material must not be placed directly in model arguments. Programmatic embeddings pass resolveV124Material and optionally persistV124Material to createReceizMcpRuntime.

The stdio executable loads the same trusted seam from RECEIZ_V124_MATERIAL_HOST_MODULE. The configured ESM module must export resolveReceizV124Material({ reference, kind, applicationId }); it may export persistReceizV124Material({ kind, applicationId, value }) to preserve refreshed sessions and exact private additions across process recreation. The module returns or stores exact material outside MCP/model output. Without this host seam, tools that require artifact/session refs fail closed instead of accepting inline authority material.

V124 dynamic authorization remains exact: authority-session open/refresh require the signed/stored challenge scopes plus receiz:<requestedRail>.write; execute/cancel re-authenticate the complete stored session grant and require the settlement or reserve rail when the operation category uses it; private additions and recipient resolution re-authenticate the stored session grant; replay/checkpoint source publication requires the active stored grant in addition to its route scope.

Historical coordinated mechanics retained from v121

V121 promotes MCP, SDK, AI Skills, registry, and application-operation identity together without creating a new authority boundary. Sealed proof objects remain the source; MCP may verify, plan, stage, append, distribute, and restore through the canonical SDK mechanics, but its responses, server state, and database projections never outrank exact artifact truth.

The v122 publication path admits the locally sealed object first and treats global publication as an idempotent append beneath that proof. It does not make a settled profile, live player, identity, or Settlement surface wait for remote confirmation, and it preserves stronger exact media, SHA-256, ownership, PBI, and composite-head fields when a partial representation arrives.

V120 living-subject parity

V120 adds 37 typed SDK-backed tools for subject identity/state/history, complete proof-brain head/search/resolve/stream, subject Twin and portable mind, memory, relationships, inventory, mandates, runtime jobs, deterministic world commands/transactions/replay, and bearer transfer.

Every result names its source primitive and registry/reducer digests. MCP never claims authority. Reads resolve through the SDK; writes require the exact stored plan or permit digest, and bearer claim independently re-inspects the exact instrument bytes before commit. Active mandates authorize only their bounded autonomous scope, and rejection returns a structured zero-write result.

The existing nine typed artifact tools remain the current enclosing-artifact coordination inventory. The living-subject inventory composes beneath those stronger proof boundaries and does not create a second authority system.

Exact v120 living-subject tool inventory

Subject identity, state, and proof-derived projections:

• receiz_subject_resolve
• receiz_subject_state
• receiz_subject_history
• receiz_subject_memory_query
• receiz_subject_relationships
• receiz_subject_inventory

Subject Twin and portable mind:

• receiz_subject_twin_profile
• receiz_subject_twin_message
• receiz_subject_twin_mind_export
• receiz_subject_twin_mind_import_plan

Autonomous mandates and durable runtime:

• receiz_subject_mandate_get
• receiz_subject_mandate_plan
• receiz_subject_mandate_activate
• receiz_subject_mandate_pause
• receiz_subject_mandate_revoke
• receiz_subject_runtime_enqueue
• receiz_subject_runtime_status
• receiz_subject_runtime_cancel

Typed world admission, transactions, and replay:

• receiz_world_additions
• receiz_world_command_plan
• receiz_world_command_validate
• receiz_world_command_execute
• receiz_world_transaction_plan
• receiz_world_transaction_execute
• receiz_world_receipt
• receiz_world_replay

Complete streamed proof brain:

• receiz_subject_brain_head
• receiz_subject_brain_search
• receiz_subject_brain_resolve
• receiz_subject_brain_stream

Bearer ownership transition and conformance:

• receiz_bearer_transfer_preview
• receiz_bearer_instrument_issue
• receiz_bearer_instrument_inspect
• receiz_bearer_instrument_claim
• receiz_bearer_transfer_cancel
• receiz_bearer_transfer_status
• receiz_living_subject_conformance

The proof-brain sequence is head → search compact references → independently resolve exact primary object bytes → stream verified passages and context receipt. The 96-object value bounds one reasoning window only; the canonical Kai/Merkle/Fibonacci history has no fixed object-count ceiling.

MCP write and authority law

Planning tools perform zero writes. Every write tool requires the exact digest of the stored plan, permit, or instrument and rejects caller-shaped substitutes. Command and transaction execution revalidate exact participant and world heads plus current capability or mandate scope. Bearer claim independently resolves and inspects the instrument bytes before one atomic transition. All failed decisions return writes: 0; retries preserve admission identity and cannot duplicate an event.

MCP responses expose their sourcePrimitive, v120 registry digest, and living-subject reducer digest. A tool result, model statement, confirmation, receipt, cache, row, or MCP memory is never proof authority. Factual memory must cite admitted event IDs, performance remains animation instruction, and multi-subject effects are atomic.

V120 Offline Note boundary

MCP exposes no separate Offline Note qualification, custody, activation, consumption, or Send authority. receiz_artifact_verify may verify the exact enclosing Note bytes through the SDK. The other current artifact tools may coordinate only their declared generic artifact mechanics.

For a transferable Offline Note, the mandatory authority sequence remains outside MCP:

verified receiz.account.state.v3 Reserve source
-> paired local Reserve-debit and held-bound Note successors
-> canonical verification and exact qualified genesis activation
then for every Send:
canonical enclosing-Note verification
-> exact qualified current custody
-> one irreversible exact-head consumption
-> one anonymous qualified next-custody commitment
-> one whole-value canonical successor
-> exact local receiver activation and Settlement

An MCP response, model memory, plan, confirmation, staged reference, receipt, server append, database row, or publication order cannot qualify a platform, deduct Reserve, release or authorize genesis, manufacture one-use custody evidence, reactivate a consumed predecessor, choose the lawful Note head, or complete Settlement. When an agent handles genesis, it must verify the carried account/Identity proof and paired account/Note successors. When it handles Note bytes, it must verify the enclosing artifact first and report any custody evidence as subordinate verified evidence only.

V120 artifact transition and reconciliation coordination

V120 preserves and extends the current transition and reconciliation authority chain, including the SDK transports receiz.native_capture.v1 and receiz.pbi.proof-object-authorship.v1. Native Capture binds the exact camera ceremony bytes. PBI authorship is available only after canonical predecessor verification, appends in verified order, settles locally before optional publication, and never transfers ownership or rewrites media/provenance. MCP may expose or coordinate those SDK results, but an MCP response is never proof authority.

The single current operations inventory contains exactly nine typed artifact tools:

• receiz_artifact_verify verifies and reports complete exact artifact bytes.
• receiz_artifact_admit verifies first, then passes only the SDK-issued verification into the selected document, portable-state, or identity admission profile.

For the identity profile, the enclosing Identity Seal/Record is the source of the SDK-verified portable state at its sealed head. recoveredState.snapshot is the accessor used to project that carried state immediately without a database read. recoveredState.completeAtSealedHead must be true and recoveredState.authority must be verified-identity-portable-state; MCP remains a transport and inspection surface beneath the enclosing Identity Seal/Record.

recoveredState.continuity is mandatory developer-visible law. It declares permanent append-only local truth, immediate complete sealed-head projection, and synchronization limited to verified descendants after that head. Global acknowledgement cannot delete local truth, and infrastructure cannot block local access or lawful use by the verified owner. MCP must not request hydration for state at or before the admitted head.

• receiz_artifact_append_plan resolves custodied verified history, actor evidence, and registry discovery out of band before calling the SDK planner.
• receiz_artifact_transition_seal_and_stage consumes a distinct execution-attempt confirmation, resolves capability/sealer/store out of band, and stages canonical successor bytes with zero head writes.
• receiz_artifact_transition_commit consumes a distinct commit confirmation and asks the injected store to independently resolve, verify, and atomically accept the staged bytes.
• receiz_artifact_global_resolve resolves one authenticated named-domain head and returns exact bytes for independent verification.
• receiz_artifact_reconcile_plan prepares the exact verified offline-history reconciliation and plan-bound capability payload without writing.
• receiz_artifact_reconcile_stage writes only confirmed, immutable, content-addressed candidate bytes without advancing a head.
• receiz_artifact_reconcile_commit independently resolves the staged version and atomically accepts the expected head after distinct confirmation.

The first five tools are also the historical v112 compatibility inventory. That historical v112 label preserves the earlier contract and does not define a second current mutation surface.

Plans, confirmations, staged references, history reports, reported actors, and receipts are explicit non-authoritative reports. They cannot be supplied back as SDK authority. A passphrase exists only for the immediate identity admission call and is never retained or serialized. The v108/v110 mutation tools are absent; unchanged historical exact bytes remain eligible for current verification and current admission.

No historical versioned MCP subpath is shipped. Generic constitutional append-event and atomic-projection property bags are denied and direct callers to the current typed tools.

Sealed proof/object truth is strongest. Receiz.com reference behavior comes before SDK, MCP, AI, and other developer rails; MCP projects and invokes that behavior without becoming proof authority.

A verified proof object is not limited to the platform that created it. Any lawful platform may append authenticated ownership and history only while preserving the same immutable object identity, payload, provenance root, prior history, and unknown namespaces, then returning a complete verified proof object. MCP plans and executes that same SDK continuity; it cannot impose an origin-platform lock or create a parallel chain.

Local artifact restore/account-state append and signed offline queue execution remain SDK-local because they operate on developer-held bytes and keys. MCP output is never proof authority.

This package is an agent interface. It is not a new proof authority. Every tool response includes the Receiz authority boundary:

• Source of truth: sealed proof objects, deterministic proof state, verified local truth, and admitted identity continuity. Receiz.com and server append rails coordinate and project beneath that truth; SDK, MCP, and AI adapt downward.
• MCP authority: false
• MCP role: expose agent-callable tools beneath Receiz proof/object truth.

V120 Application Contract Compiler

The MCP server exposes the shared @receiz/sdk application compiler through receiz_project_inspect, receiz_app_contract_create, receiz_app_plan, receiz_app_apply, receiz_app_check, receiz_app_upgrade, and receiz_app_explain.

Inspection, contract proposals, planning, checking, upgrade planning, and explanation are read-only. receiz_app_apply first returns every affected file and a deterministic digest. It writes only after the caller supplies that exact digest as explicit confirmation. All paths remain inside the explicitly supplied repository root, and repeating an applied plan produces no changes.

Inspection and checking emit critical release-blocking findings for payload fallback, passing complete artifact bytes to a domain payload parser, downloading original payload after Record or Seal failure, and manually repacking SDK artifact bytes with caller-selected MIME metadata. receiz_app_repair refuses to apply while those violations remain, and receiz_release_qualify reports the exact blocking findings.

Every result states that MCP is not proof authority. Repository inspection does not verify an artifact. Verification remains the SDK's continuity-bound verification.verifyArtifact, and proof-object creation remains authenticated native Record before Seal.

Schema resources are available at receiz://schemas/app-contract-v1, receiz://schemas/integration-plan-v1, receiz://schemas/upgrade-rules-v1, and receiz://schemas/generated-files-v1.

Install

npm install @receiz/mcp-server @receiz/sdk

The matching @receiz/ai-skills package is installed with both packages. Agent hosts can load all 43 skills, 37 manifests, and 34 OpenAI agent prompts from node_modules/@receiz/ai-skills; MCP resources and the skills teach the same continuity-bound verification law without becoming proof authority.

Run the server:

npx -y @receiz/mcp-server

For local development in this repo:

pnpm mcp:test
pnpm mcp:build

Environment

Public reads work without a bearer token when the underlying Receiz rail is public.

Delegated writes require a Receiz-issued Connect/OIDC access token. Create one from /developers/connect with Create Delegated Agent Token. The dashboard shows the bearer token once, returns a revocation token ID, and labels actions with an agent:* audit label.

RECEIZ_BASE_URL=https://receiz.com
RECEIZ_ACCESS_TOKEN=<delegated-agent-access-token>
receiz-mcp

Use RECEIZ_CONNECT_ACCESS_TOKEN as an alias if that is how your app stores delegated Connect access. Run receiz_mcp_login from an MCP host to get the dashboard URL, recommended scopes, exact config snippet, and an OIDC authorize URL when you pass clientId, redirectUri, and codeChallenge.

MCP Host Config

Claude Desktop / Cursor-style config:

{
  "mcpServers": {
    "receiz": {
      "command": "npx",
      "args": ["-y", "@receiz/mcp-server"],
      "env": {
        "RECEIZ_BASE_URL": "https://receiz.com",
        "RECEIZ_ACCESS_TOKEN": "<optional delegated token>"
      }
    }
  }
}

Tools

Core diagnostics:

• receiz_doctor
• receiz_capabilities
• receiz_required_scopes
• receiz_runtime_blueprint

Identity and tenant sessions:

• receiz_authorize_url
• receiz_mcp_login
• receiz_ensure_tenant_session

Durable public app state:

• receiz_app_state_publish
• receiz_app_state_resolve
• receiz_app_state_by_url
• receiz_app_state_by_creator
• receiz_app_state_by_namespace
• receiz_app_state_by_id

Commerce/store projections:

• receiz_public_store_publish
• receiz_public_store_resolve

receiz_public_store_publish is the delegated agent/server write lane. For merchant-owned storefront state, use the SDK signed publish lane:

await receiz.publicStore.publishWithIdentityProof({
  keyFile,
  tenantHost,
  merchantReceizId,
  storeStateRecord,
});

That path uses the merchant Identity Seal / Receiz Key as authority and does not require RECEIZ_ACCESS_TOKEN.

Proof resolution and inspection (not verification):

• receiz_inspect_offline_file (shape inspection only; always verified: false)
• receiz_asset_by_url
• receiz_asset_by_id
• receiz_inspect_proof_object
• receiz_proof_query

Receiz public rails:

• receiz_wallet_public_ledger
• receiz_action_ledger
• receiz_sports_conformance
• receiz_world_public_snapshot
• receiz_pitch_proof_by_witness_id
• receiz_card_history

Previews and templates:

• receiz_transfer_preview
• receiz_transfer_requires_confirmation
• receiz_pack_open_preview
• receiz_marketplace_template_generate

Webhooks:

• receiz_webhook_events_catalog
• receiz_webhook_register_endpoint
• receiz_webhook_rotate_secret
• receiz_webhook_send_test_event
• receiz_webhook_receiver_scaffold
• receiz_webhook_verify_payload

Use receiz_webhook_events_catalog first, then receiz_webhook_register_endpoint with the payment preset or explicit event types. Register and rotate return the plaintext endpoint secret once. receiz_webhook_receiver_scaffold returns a receiver that verifies delivery before parsing and reminds the agent to verify the underlying proof object, ownership append, or settlement ledger event before admitting product truth.

Sandbox:

• receiz_sandbox_seed_store
• receiz_sandbox_checkout

Current sealed artifact coordination—one nine-tool inventory:

• receiz_artifact_verify
• receiz_artifact_admit
• receiz_artifact_append_plan
• receiz_artifact_transition_seal_and_stage
• receiz_artifact_transition_commit
• receiz_artifact_global_resolve
• receiz_artifact_reconcile_plan
• receiz_artifact_reconcile_stage
• receiz_artifact_reconcile_commit

const currentReceizArtifactTools = Object.freeze([
  "receiz_artifact_verify",
  "receiz_artifact_admit",
  "receiz_artifact_append_plan",
  "receiz_artifact_transition_seal_and_stage",
  "receiz_artifact_transition_commit",
  "receiz_artifact_global_resolve",
  "receiz_artifact_reconcile_plan",
  "receiz_artifact_reconcile_stage",
  "receiz_artifact_reconcile_commit",
]);

if (currentReceizArtifactTools.length !== 9) throw new Error("MCP artifact inventory drift");

The historical v112 compatibility inventory is exactly the first five entries above. It remains historical documentation, not another current inventory.

Every input schema is strict. No tool accepts raw verification, admission, history, actor evidence, plan, capability, candidate, staged reference, receipt, sealer, store, public key, or artifact-authority bags.

Additional semantic tools:

• receiz_app_repair previews repository-confined repairs and requires the exact digest before writing.
• receiz_proof_trace invokes canonical artifact verification for byte-bearing inputs; inspection-only input receives no verified verdict.
• receiz_webhook_replay verifies the captured delivery, previews its digest, and requires exact confirmation for idempotent replay admission.
• receiz_scope_explain reads the canonical SDK capability descriptor.
• receiz_release_qualify returns read-only repository and receiz.sdk.conformance_report.v1 evidence.

Resource Templates

Agent hosts can expose these Receiz resource templates:

• receiz://asset/{id}
• receiz://proof/{id}
• receiz://pitch/{witnessId}
• receiz://store/{tenantHost}
• receiz://sdk/docs
• receiz://schemas/proof-object-v1

Full Receiz App Loop

An agent can build a full Receiz app with this sequence:

1. Run receiz_doctor and receiz_capabilities.
2. Use receiz_required_scopes for the app rails it needs.
3. Use receiz_mcp_login, receiz_authorize_url, or receiz_ensure_tenant_session for Connect/OIDC setup.
4. Use receiz_public_store_resolve or receiz_app_state_resolve for cold-start first paint.
5. Render known verified projection truth immediately.
6. Publish verified additions with receiz_public_store_publish or receiz_app_state_publish.
7. Use receiz_asset_by_url, receiz_asset_by_id, and receiz_inspect_proof_object to resolve and inspect proof surfaces. Use @receiz/sdk verification.verifyArtifact(file) for the indivisible integrity-and-continuity verdict.
8. Use receiz_webhook_events_catalog, receiz_webhook_register_endpoint, and receiz_webhook_receiver_scaffold for event delivery.
9. Use ledger/world/sports/proof-query tools for dashboards and advanced experiences.

Authority Boundary

Receiz truth hierarchy is preserved:

1. Sealed artifact truth
2. Deterministic proof object state
3. Verified local truth
4. Verified register append
5. Authenticated SDK/API projection
6. MCP tool result

MCP may inspect, resolve, publish through delegated SDK calls, and report. MCP must never replace, rename, or outrank a Receiz proof object, identity primitive, settlement primitive, ownership surface, or public proof surface.

Highest Cash-Out Frame

source + law + sequence + object + evidence. And the reader underneath them.

MCP is the reader layer. Every MCP capability projection carries this SDK-bound frame beneath the sealed proof object and may never reorder or replace the authority it reads.

Canonical trust host for stdio

The stdio executable enables the 39 trust operations with RECEIZ_APPLICATION_ID and RECEIZ_V125_TRUST_HOST_MODULE (an absolute file URL or module specifier). The module exports createReceizV125TrustHostConfiguration({ client, applicationAudience }). Return the private custody and mechanics accepted by createReceizV125TrustMcpOperations: materialOptions, attestation, credentialPresentation, pbiCeremony, subjectCoordination, subjectMessage, and/or externalExecution. The executable constructs the canonical dispatcher itself using its exact runtime client and audience. An arbitrary operation callback, a replacement client, or a replacement audience is rejected. Missing mechanics report unavailable with zero writes.

Keep sealed bytes, identity material, provider delivery payloads, and signing mechanics inside the host. Model arguments carry opaque references and exact confirmation only. subjectMessage composes the SDK-opened complete thread family, Identity/PBI-authored close event, signed append capability, and atomic source store. Its supported effect is close; encrypted message effects remain rejected. Its store must retain and reopen the complete sealed successor family and atomically enforce participant heads and PBI consumption.

externalExecution supplies fixed profiles, an outcome/idempotency store, and a provider delivery function. Private plan material carries profileId, operationId, request, idempotencyKey, and sources; each profile-required source is { artifact, expectedHead } using the exact enclosing sealed artifact. The canonical host admits those sources before deriving the plan's proof heads. Provider delivery receives the exact request, profile, heads, plan identity, request digest, and stable idempotency key. Pending/unknown evidence cannot become a terminal outcome. Execution requires a fresh exact preview confirmation; retries keep the SDK delivery identity, and reads perform no provider call. Opaque plan/result references retain same-runtime custody; use host persistence for durable outcome storage. A process restart requires a new canonical plan and confirmation, while the durable SDK outcome/idempotency store prevents redelivery.

The actual-bin integration fixture exercises canonical trust configuration, source-bound close, PBI consent, attestation issuance, credential presentation, and typed external execution. Published npm 126.0.0 bytes remain historical; this source inventory is the coordinated release candidate, not a claim that those immutable tarballs contain later operations.

v127 offline file sealing

Run the installed receiz-mcp command with RECEIZ_OFFLINE_SEAL_DIRECTORY pointing to private durable custody and RECEIZ_OFFLINE_WORKSPACE pointing to the source/output directory. No custom sealer resolver module is required for these tools.

1. receiz_offline_seal_enroll({ "confirmEnrollment": true }) once online.
2. Restart disconnected; receiz_offline_seal_status({}) reports readiness.
3. receiz_offline_seal_file({ "inputPath": "report.pdf", "outputPath": "report.receized.pdf", "mimeType": "application/pdf" }).
4. receiz_offline_verify_file({ "inputPath": "report.receized.pdf" }).

Paths must remain inside the configured workspace. Existing output files are never overwritten. Custody files cannot be used as source/output. MCP returns verification and output coordinates, never private keys. AI instructions invoke these tools; they do not confer proof authority.

Authority and qualification

The device certificate authorizes canonical artifact signing. It does not create a Receiz ID, confer another person's ownership, admit a transfer, or execute settlement. Those operations retain their existing proof boundaries. No root signing key or server credential is shipped. Node custody contains a device private key in a mode-0600 file and must remain private; browser custody uses IndexedDB.

Qualify with networking disabled after restarting: seal supported PNG, PDF, SVG, JSON, JPEG, HEIC, WebP/GIF and ordinary text; save and reopen the exact output; verify it; reject tampered bytes. HEIC container tests do not establish physical Photos byte preservation. There is no new claim about Camera Roll transformations.