Every WCP dispatch — approved or denied — produces a signed work ticket: the evidence receipt.
It proves what happened, when, and why.
What the receipt proves:
- What capability was requested, and by which tenant
- Which worker was selected (or why dispatch was refused)
- What controls were verified before dispatch
- What the blast radius was assessed to be
- Whether a human gate was passed, required, or waived
- The exact UTC timestamp of the decision
How integrity is enforced:
The receipt JSON is SHA-256 hashed. Any modification to the receipt content
breaks the hash. In a compliant WCP deployment, receipts are appended to
a tamper-evident audit log.
Why denied receipts matter:
A "HALL REFUSED" receipt is as important as an approved one. It proves the
governance layer was active and working.
Policy gates vs blast radius:
The blast radius check runs first. If blast score ≥ 85 in prod/edge,
dispatch is refused automatically.