SOP-02 — Receipt production

Owner: Owner-operator (Document Owner and Records Owner for every SOP; no delegate exists). Version 2026-10-07 · effective 2026-10-04 · reviewed every 90 days · last reviewed 2026-10-07 · next review due 2027-01-05.

Purpose

Produce one receipt that states, for each check, what the official file printed on the read date, the method of matching, and any source that did not answer, and record it with a hash.

Scope

screening.build and receiptspec.record for every origin: public page, partner API, roster batch, Receipt Watch, prebuild, challenge.

Procedure

Inputs are the name as supplied and any official keys (UEI, NPI, EIN, CCN, CIK, LEI, CAGE). Keys are passed by keyword, never by position (a positional call miskeyed 181 receipts in 2026-09; see PB-CCN-307B0E).
Each check reads its own source (held file or live endpoint) and returns rows as printed, the file date or read time, the exact query, a state (answered / did_not_answer / not_read) and its match method.
No check may return an empty result when its source did not answer; it must return did_not_answer (SOP-04).
The receipt body is serialised canonically and SHA-256 hashed; the hash is the receipt's identity. source_telemetry records per-check state, latency and held-file date/sha.
receiptspec.record refuses a body containing verdict language (forbidden-words list in the receipt specification) and writes the registry row: id, hash, keys, origin, snapshot, telemetry, time.
Receipts are never edited after record. A wrong receipt is handled under SOP-06.
Optional 'supports_forms' block: the requester may name up to six form ids from the Government Forms Register (?forms= on the public endpoints, 'forms' field on the partner receipt, 'forms' column on a roster CSV). The block prints the form, line, citation, official page, what the receipt is for that line and what it does not prove, and is hashed with the body. Naming a form never changes what is read; unknown ids are refused (422).

Records this procedure produces — and who keeps them current

Record	Where	Updated by	Update trigger	Retention	Public
Receipt registry row	`db.receipt_registry`	system at record time; owner only via SOP-06 withdrawal annotation	every receipt	indefinite	True
Receipt body	`db.receipt_registry.body (public when published)`	system	every receipt	indefinite	when published

Evidence

/api/spec/receipt/v1 · /methodology · /api/trust/registry-freshness

Change log

Date	Change
2026-10-04	source_telemetry added to every receipt.
2026-10-06	Written as SOP.
2026-10-07	Evidence link corrected: /api/receipts/spec (404) → /api/spec/receipt/v1.
2026-10-07	Owner: 'build what is needed' to tie receipts to the Government Forms Register. supports_forms block added (optional, requester-named, hashed with the body) on public, partner and roster receipts; HTML receipt prints it after Identity; re-run line carries forms=. Register grew 13 → 25 federal forms with a 'not served' list.
2026-10-07	Owner: use the forms to show companies what is supposed to be conducted and their own record against it. Added per-form Procedures (steps as the regulation writes them, actor, when, record, citation, auditor's test — /api/public-record/forms/{id}/procedure and printable /html), Form Finder (/forms/finder), roster Coverage Ledger (GET /api/batch/{id}/coverage: rows with dated record / none held / source silent, by receipt step; counts and dates only), Record History (/api/public-record/history: what each source printed by year; no trend or score), and a forms_named field on every registry row so /forms shows 'named on N receipts' and Road Watch reports it.

Quality Manual · All SOPs · Records Register