chore(receipts): schema audit and canonicalization for SIEM-readiness

[solomonneas]

Summary

Audits verification receipts, Brigade run receipts and sidecars, and outcome records against four SIEM-readiness criteria:

• deterministic field names
• stable sorted-key serialization
• append-only semantics
• documented machine-readable schema versions

New writes carry a documented schema_version, legacy receipts without the field still load, and verify version 2 keeps its patch-identity tuple structurally stable. The schema reference permits additive optional fields within a version so concurrent receipt-field work can merge without changing the contract.

Findings

Tag	Count
compliant	24
fixed-here	14
needs-follow-up-issue	7

The committed audit report maps each receipt type and criterion to its tag. The schema reference lists fields, types, null and omission rules, and evolution policy.

Follow-up issues filed

1. runs: add an append-only lifecycle journal and replayable run.json projection #568, receipts: replace mutable run.json snapshots with append-only lifecycle events
2. receipts: preserve worker and synthesis sidecars across resume and patch-ref updates #567, receipts: preserve worker and synthesis sidecars across resume and patch-ref updates
3. receipts: archive verification evidence before retention pruning #565, receipts: archive verification evidence before retention pruning
4. outcome: make decision receipt filenames collision-safe and write-exclusive #564, outcome: make decision receipt filenames collision-safe and write-exclusive
5. outcome: serialize digest-chain appends across concurrent captures #566, outcome: serialize digest-chain appends across concurrent captures

Verification

Full suite:

brigade work verify run --target . --command "./scripts/verify" --capture brigade-work
receipt: 20260726-221100-work-verify-b71529
exit: 0
4404 passed, 3 skipped in 430.74s

Determinism proof:

brigade work verify run --target . --command "cmp /tmp/brigade-506-receipt-v2-a.json /tmp/brigade-506-receipt-v2-b.json" --capture brigade-work
receipt: 20260726-221839-work-verify-2208e1
exit: 0

The two files were generated from the same payload through aboyeur._write_json. A zero-exit byte comparison confirms identical serialization.

Closes #506

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 33b09ee9-ca1e-42da-a624-a6d1578b965a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/506-receipt-schema-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}