Provable Receipt

A proof you can't run isn't a proof

1.2 shipped Sendable Memory with a receipt — a falsifiable, 60-second demo that a soul can be sealed into a packet, sent as a file, and merged on arrival. Good. But running that receipt meant cloning the repo and installing test dependencies.

That's a gap. If the whole idea is don't take our word, check it yourself, then checking it yourself has to be trivial — otherwise the receipt is a receipt in name only. A proof behind a setup wall is a weaker claim than it looks.

So 1.3 closes the wall. The receipt now lives inside the package, one command away:

A reader who runs that line is the proof. That's the whole point.

What's New

• claude-fafm-sdk receipt — runs the full Tier-2 arc in-process (etch → seal → send a file → merge → recall) and the three falsifiers below. Exit 0 + a GREEN banner on pass; non-zero if any check fails. --json for a machine-readable PASS.
• claude-fafm-sdk open — open a .fafmp packet → write .fafm or print a summary. Fail-closed: a bad packet exits non-zero, never a partial write.

The 60 seconds, and the three falsifiers

The happy path is one line; the credibility is that it also tries to break itself:

• CRC-reject — flip one byte of a sealed packet → it's rejected, the local soul is untouched.
• Double-merge idempotent — apply the same packet twice → no duplicate facts.
• Both-ways converge — seal two replicas, cross-merge them → the same logical soul either direction.

Green, or it doesn't ship. --json gives you the same result machine-readable, for CI or a paper.

Honesty bounds

• The receipt exercises transport + ingest — sealing, sending, and the CvRDT merge on arrival. It does not re-prove the dual-implementation merge itself; that's the 1.1 story and it still stands.
• CRC = integrity, not authentication — a packet proves it wasn't corrupted, not who sent it. No signing, no encryption. (Signing is the next edition — Verifiable Provenance.)
• Grow/update-only — deletes don't converge yet. (That's the edition after — Forgettable Memory.)
• Same namepoint across replicas, and SPK1 is the packet seal — not the full FAFB binary, no IANA media type.

Try It

That first line clones nothing, sets up nothing, and either prints GREEN or tells you exactly which check failed. Private notes stay private; the receipt is public — because you can run it.

The Numbers

• v1.3.0 — production on PyPI (Provable Receipt)
• 1 command — uvx claude-fafm-sdk receipt, no git clone
• 3 falsifiers — CRC-reject · double-merge idempotent · both-ways converge
• PyPI: claude-fafm-sdk 1.3.0