{"lexicon":1,"id":"money.atmosphere.payment.proof","defs":{"main":{"type":"record","key":"tid","description":"EXPERIMENTAL DRAFT — not published. An IMMUTABLE remote attestation written to the attester's own repository. It is written BEFORE the receipt so the receipt's `proofs` array can reference it by strongRef. This record is never updated, rewritten, or given a status, so its strongRef remains exact forever. A proof produced under the lifecycle-authority producer role is paired with a money.atmosphere.payment.lifecycle record at the SAME record key; a referenced non-lifecycle proof has no lifecycle sidecar. Which verified proof paths a consumer treats as lifecycle-authoritative is verifier-local policy, and neither this record nor the receipt's `transactionIdAuthority` field by itself confers lifecycle authority. What a proof establishes is that the repository-controlling attester asserted the settlement transition for the exact committed receipt bytes. Trust in that external-world assertion is therefore trust in the attester under verifier-local policy; this is not a trustless proof of real-world events and implies no human review.","record":{"type":"object","required":["cid","profile"],"properties":{"cid":{"type":"string","format":"cid","description":"Canonical payment-v1 commitment CID string: lowercase unpadded base32 CIDv1, DAG-CBOR codec 0x71, SHA-256 with a 32-byte digest. This is the inner receipt commitment, not the proof record's repository-record CID: it is computed under the profile named by `profile` over the receipt record minus `proofs`, plus `$commit` = { profile, author }. See COMMITMENT_PROFILE.md. Because the author DID is committed, a record copied to a different author cannot validate against this proof."},"profile":{"type":"string","maxLength":64,"knownValues":["money-atmosphere-v1"],"description":"Commitment-profile token identifying the exact byte-level commitment algorithm. Also committed inside the `$commit` metadata (domain separation: the same fields under a different profile produce a different CID). Verifiers MUST fail closed on unknown profiles."}}}}}}