Diagnostic receipts

What Mesh returns when things work, pause, or fail closed

Receipts are the shared support and audit object across REST, gRPC, SDKs, logs, and customer escalation. Every receipt preserves request ID, correlation ID, client identity, and contract version.

Successful HSM signing

KEYSTORE_PKCS11_SIGNATURE_COMPLETED

COMPLETED

{
  "receipt_id": "rcpt_sig_001",
  "state": "RECEIPT_STATE_COMPLETED",
  "reason_code": "KEYSTORE_PKCS11_SIGNATURE_COMPLETED",
  "request_id": "req_demo_001",
  "correlation_id": "corr_demo_001",
  "contract_version": "mesh-v1.0.0-m2",
  "client_name": "walletkit",
  "client_version": "0.1.0-m0",
  "message": "Provider-backed HSM signing completed."
}

Unsupported contract version

UNSUPPORTED_CLIENT_CONTRACT_VERSION

DENIED

{
  "receipt_id": "rcpt_contract_001",
  "state": "RECEIPT_STATE_DENIED",
  "reason_code": "UNSUPPORTED_CLIENT_CONTRACT_VERSION",
  "request_id": "req_old_001",
  "correlation_id": "corr_old_001",
  "contract_version": "mesh-v1.0.0-m1",
  "client_name": "legacy-client",
  "client_version": "0.1.0-m0",
  "message": "Unsupported Mesh contract version. Preferred Mesh contract version: mesh-v1.0.0-m2."
}

Missing VaultCore authorization

KEYSTORE_SIGNER_AUTHORIZATION_REQUIRED

DENIED

{
  "receipt_id": "rcpt_auth_001",
  "state": "RECEIPT_STATE_DENIED",
  "reason_code": "KEYSTORE_SIGNER_AUTHORIZATION_REQUIRED",
  "request_id": "req_auth_001",
  "correlation_id": "corr_auth_001",
  "contract_version": "mesh-v1.0.0-m2",
  "client_name": "walletkit",
  "client_version": "0.1.0-m0",
  "message": "HSM PKCS#11 signing requires typed VaultCore signer authorization."
}

HSM key not found

KEYSTORE_PRIVATE_KEY_NOT_FOUND

DENIED

{
  "receipt_id": "rcpt_key_001",
  "state": "RECEIPT_STATE_DENIED",
  "reason_code": "KEYSTORE_PRIVATE_KEY_NOT_FOUND",
  "request_id": "req_key_001",
  "correlation_id": "corr_key_001",
  "contract_version": "mesh-v1.0.0-m2",
  "client_name": "walletkit",
  "client_version": "0.1.0-m0",
  "message": "Configured signer binding did not resolve to exactly one compatible private signing key."
}

Approval pause

HUMAN_APPROVAL_REQUIRED

PENDING_APPROVAL

{
  "receipt_id": "rcpt_pause_001",
  "state": "RECEIPT_STATE_PENDING_APPROVAL",
  "reason_code": "HUMAN_APPROVAL_REQUIRED",
  "request_id": "req_pause_001",
  "correlation_id": "corr_pause_001",
  "contract_version": "mesh-v1.0.0-m2",
  "client_name": "walletkit",
  "client_version": "0.1.0-m0",
  "message": "Session paused until the required approval witness is supplied."
}

Provider unavailable

KEYSTORE_PROVIDER_UNAVAILABLE

DENIED

{
  "receipt_id": "rcpt_provider_001",
  "state": "RECEIPT_STATE_DENIED",
  "reason_code": "KEYSTORE_PROVIDER_UNAVAILABLE",
  "request_id": "req_provider_001",
  "correlation_id": "corr_provider_001",
  "contract_version": "mesh-v1.0.0-m2",
  "client_name": "walletkit",
  "client_version": "0.1.0-m0",
  "message": "Configured PKCS#11 provider was unavailable; no local signing fallback was attempted."
}