# description
The in-toto Statement predicate carried by a governance attestation: the GovernanceReceipt body (CADF spine + governance linkage) augmented with the DID-shaped `signer` and `recordedAt` evidence-layer fields. Tracks @appitudeio/governance v1.0.0. The `predicateType` URI carries the MAJOR version only; the precise shape SemVer rides in `schemaVersion` (governance ADR 0018). predicateType: https://schemas.governedwork.com/attestation/governance-receipt/v1

# properties.schemaVersion.description
The GovernanceReceipt SHAPE version, full SemVer 2.0.0 (governance ADR 0018). The `predicateType` URI carries the MAJOR only; this pins the precise shape version IN the signed predicate. The verifier rejects any other value fail-closed — a receipt minted before this field existed (pre-1.0 rc-era, same `/v1` URI) is not recognized. A future 1.1.0 is a conscious ADR + spec-version event.

# properties.observer.description
CADF observer — the kernel that recorded the event (its did:web Identity).

# properties.action.description
Branded ActionName — dot-namespaced, channel-bearing. Join key into the trusted ActionDefinition registry.

# properties.intentRef.description
Branded IntentId — the caller-minted idempotency key; the receipt's stable identity.

# properties.decisionRef.description
Signed link back to the Decision that authorized the action.

# properties.approvalRef.description
Signed ApprovalRef envelope when the action required approval, or null for a direct allow.

# properties.signer.description
The DID subject that signed (assertionMethod key). Evidence-layer field of AttestationPredicate.

# properties.recordedAt.description
When the attestation was minted. Default valid-at-time instant for key-validity checks; self-asserted.

# properties.recordedAt.$comment
Deliberately STRICTER than the implementation type: TS AttestationPredicate.recordedAt is a plain string, but the wire contract requires a parseable RFC-3339 instant (it is the default key-validity evaluation time).

# $defs.IsoDateTime.description
ISO-8601 / RFC-3339 instant. Offset-aware (carries Z or ±HH:MM) is expected.

# $defs.Identity.description
The unified actor type (DID subject). `did` is OPTIONAL (session-only humans / not-yet-DID machines).

# $defs.Identity.properties.ref.description
Branded IdentityRef — the stable join key (the DID when present, else a consumer-supplied principal id).

# $defs.SignatureAlg.description
Signature algorithms the substrate's emitter accepts. The VERIFIER supports only Ed25519 and ECDSA_SHA_256; a bundle claiming RSASSA_PSS_SHA_256 fails closed at verify.

# $defs.Signer.description
An Identity exercising an assertionMethod key. A verifiable signer's identity.did is required in practice (the verifier resolves the verification method from it), though Identity.did is type-level optional.

# $defs.Signer.properties.keyId.description
verificationMethod fragment within the DID document (the part after #).

# $defs.ResourceRef.description
CADF target — a closed, kind-discriminated union of generic governed-resource types.

# $defs.GovernanceOutcome.description
CADF Outcome taxonomy, narrowed to the three values a governed action produces.

# $defs.ExecutionPayload.description
Binds the executed payload back to the approved/decided intent.

# $defs.ExecutionPayload.properties.hash.description
canonical-JSON SHA-256 of the payload that actually executed.

# $defs.ExecutionPayload.properties.derivedFromIntentHash.description
the intentHash of the approved/decided intent this payload was derived from.

# $defs.Execution.description
What the governed action did. `payload` is non-null for an executed outcome (success/failure) and MAY be null for pending — enforced at emit, not expressible in this schema.

# $defs.Execution.properties.kind.description
executor class (communication.send | workflow.run | http.call | …).

# $defs.DecisionRef.description
Signed link back to the Decision. A reference, not the full decision; the load-bearing facts are lifted into the signed predicate.

# $defs.DecisionRef.properties.intentId.description
Branded IntentId — the join key (same as the receipt's intentRef).

# $defs.DecisionRef.properties.intentHash.description
canonical-JSON SHA-256 of the decided intent body.

# $defs.DecisionRef.properties.outcome.description
Decision.outcome — almost always allow on an attested action.

# $defs.DecisionRef.properties.actionDefinitionHash.description
canonical-JSON SHA-256 of the trusted ActionDefinition the decision resolved.

# $defs.DecisionRef.properties.policyBundleHash.description
hash of the policy world the decision was evaluated under.

# $defs.DecisionRef.properties.decisionProvenanceHash.description
umbrella anchor: canonical-JSON SHA-256 of the whole DecisionProvenance.

# $defs.ApprovalState.description
Approval lifecycle states (GNAP grant-request lifecycle + expired).

# $defs.ApprovalRef.description
Signed link back to the ApprovalRequest. Carries the resolution snapshot so the receipt is self-contained. `resolvedAt` is present IFF state is approved/rejected — that conditionality is enforced at emit, not in this schema.

# $defs.ApprovalRef.properties.approvalRequestId.description
Branded ApprovalRequestId — the join key into the approval store.

# $defs.ApprovalRef.properties.approvalRequestHash.description
umbrella anchor: canonical-JSON SHA-256 of the approval-request resolution snapshot.

# $defs.ApprovalRef.properties.intentHash.description
canonical-JSON SHA-256 of the approved intent body — the divergence detector.

# $defs.ApprovalRef.properties.requestedAt.description
when the approval was raised (the request's createdAt).

# $defs.ApprovalRef.properties.resolvedAt.description
OPTIONAL — when the approval was resolved. Present IFF state is approved/rejected; absent for expired/pending.