Contracts and deliveries

A contract is an obligation to keep proving something. A delivery is the signed proof. Every scan produces one, and it is the artifact the rest of the platform — including the buyer's side — is built on.

A contract records that a supplier owes a buyer a fresh attestation about a product, and how often. It moves through a simple life: set up as a draft, active while in force, and ended when the relationship closes.

Ending a contract does not invalidate its history. Deliveries minted under a contract stay valid and verifiable after it ends. A buyer who received an attestation keeps something that can still be checked years later — otherwise the attestation would only have been worth as much as the commercial relationship, which is not worth much.

A delivery is the shareable, signed artifact produced from a measurement. It goes through three steps:

1. Minted — the evidence and its provenance are captured: the verdict, the exact commit measured, the rubric version, the declared quality bar.
2. Signed — the verdict is recomputed and the package frozen and signed, so any later alteration is detectable.
3. Published — registered with the registry, from which an authorised buyer can fetch it.

Its whole history is reconstructible, because an artifact that is shared externally has to be auditable and tamper-evident long after the fact.

Publishing a delivery does not make it public. Access is granted to specific buyers by the supplier, and can be withdrawn. Sharing a result with one customer does not release it to the market.

A buyer fetches a granted delivery, verifies the signature, re-derives the verdict to confirm it reproduces, and assesses it against their own acceptance criteria. None of that recomputes the score — the numbers in a delivery are echoed, never adjusted.