Receipt v1 Test Vectors
Each receipt JSON file is a full v1 envelope with blake3 and sha256 set to the
expected canonical hashes.
manifest.json repeats the expected canonical digests for convenience.
Signature fields in receipt_v1_signed.json are placeholders and are not
expected to verify unless explicitly noted in manifest.json.
Canonical bytes are computed by:
- removing hash and signature fields (
hash_alg,blake3,sha256,sig_alg,signer_pub,signature,signed_at) - recursively sorting object keys
- serializing as compact UTF-8 JSON (no trailing newline)