explorer
What is a CROWN receipt?
A signed, hash-chained record of one action, verifiable offline
corecruxctl verify-store --mode full --strict ok: true · 4 receipts · chain intact
Signatures bind to both the receipt id and the payload hash, so a receipt cannot be edited in place or transplanted elsewhere; ordering is carried by chained segment seals on the spine. You can run this exact experiment on your own machine: scripts/demo-receipt-tamper.sh in the Crux repo.
A CROWN receipt is the unit of evidence in CueCrux: a signed record of one state mutation, minted by the Crux Daemon at the moment the mutation happens.
Each receipt is signed with Ed25519, and the signature binds to both the receipt id and the payload hash, so a record cannot be edited in place or transplanted into another trail. Receipts are then sealed into segments on an append-only spine, and each segment seal commits to the hash and sequence of the seal before it (BLAKE3). That seal chain is what turns a log into evidence: insert, edit or delete anything and verification fails at that point. There is no quiet history rewrite.
A receipt resolves back to identity. Because every connection binds to a passport and every tool call carries it, you can take any receipt and answer who acted, at what trust tier, under which grants. Refused actions leave evidence too: RCX refusals fail closed with a signed RefusalReceipt carrying a reason code. Metered credit spends mint receipts as well, which is why a CueCrux bill can be audited action by action.
Verification does not depend on us. corecruxctl verify-store checks a live store; a context export can be verified entirely offline, and a tampered export is rejected. That rejection path runs as a release-blocking CI gate on every release.
The practical effect: when someone asks what an agent did, you do not offer a narrative. You hand over a chain of signed records and let them check it themselves.