IDV/KYC Session Evidence Receipt Builder

Attests the session record AS DECLARED by the verifier: NOT detection quality, NOT that the subject is genuine. Zero PII: consumes digests/booleans/scores only, never images or biometrics; raw-data-shaped inputs are rejected. That rejection is a shape check: it cannot tell a digest of a photograph from a digest of a document number, so it stops raw PII but does not stop a reversible commitment. See the document-check note below.

🔒 DOCUMENT-CHECK DIGEST COMMITMENT (OpenChainGraph Standard §25, ocg-private-input@1). The capture-chain manifest digest is bound to a capture event and is high-entropy, so it stays a plain digest and is not covered here. The document-check digest is different: this tool never pinned it off enumerable values, so you may be digesting a document number, an expiry date, or another small structured field. A bare hash of one of those is NOT safe — the value space is small, so an attacker holding the artifact can precompute the digest of every candidate and recover the plaintext by table lookup. If that describes your input, supply the digest as a sha256-salted@1 commitment — sha256: + the hex SHA-256 of a fresh ≥256-bit secret salt you generate and keep, concatenated with the canonicalized value — and declare the scheme below. The salt stays with you: it never leaves your hands, is never entered here, and never appears in the artifact. Accepted commitments are listed in the artifact's private_inputs[]; leave the scheme field blank only for sessions that predate this contract.