What Must the Log Reveal? Minimal-Disclosure Receipts for Verifiable Evidence Delivery

Can salted, ordered, independently witnessed invocation receipts preserve exact application-observable evidence delivery for authorized audit while keeping raw prompts and source text out of routine telemetry, with acceptable leakage, false-alarm, storage, latency, and reconstruction costs?

Proposes Minimal-Disclosure Invocation Receipts (MDIR): an instrumentation and privacy round about what an evidence log must reveal. E20-A is an executed deterministic development harness: 76 of 76 named checks across 96 constructed episodes, eight synthetic task families, twelve corruption families, and 6,912 mutated episode-arm evaluations, with 480 valid reveals verified and 480 altered reveals rejected. Zero language-model calls. These are protocol and engineering-diagnostic results, not model performance or production-security results. E20-B and H20-1/H20-2/H20-3/H20-4 are proposed and untested. No new model benchmark, model call, human annotation, production database inspection, collector deployment, or Noetis reasoning change.

• Endpoint and generic operational records miss evidence-specific corruption: A0 detected 2 of 12 mutation families and A1 detected 4 of 12, while content-bound receipts detected all 12 across 96 episodes with zero clean false positives. Constructed-fixture results, not model performance.
• An operator-only digest chain does not survive a privileged rewrite by that operator: after simulated rewrite, operator-only arms detected 0 of 12 families. Receipts bind observable delivery under assumptions; they do not prove source truth, completeness before emission, provider-internal processing, semantic support, or causal evidence use.

• E20-A Deterministic minimal-disclosure receipt development harness Executed (diagnostic)
• E20-B Held-out receipt comparison against strong generic traces Proposed

• H20-1 Under authorized reveal, MDIR reaches at least 0.95 exact exposure reconstruction with no more than a 0.03 absolute deficit from inline logging, while routine raw sensitive bytes remain zero.
• H20-2 An independent checkpoint detects at least 0.99 of seeded post-checkpoint operator rewrites with false-alarm rate at most 0.01, outperforming operator-only chains by at least 0.20 absolute detection.
• H20-3 Median reviewer time for MDIR stays within 25 percent of inline logging, and false integrity assurance does not exceed it by more than 0.01.
• H20-4 At the synthetic live boundary, p95 receipt creation plus durable checkpoint enqueue stays under the stricter of 5 ms or 5 percent of non-model orchestration latency, with median public receipt size under 2 KiB.

Proposed instrumentation only. No Noetis behavior, inference, routing, billing, risk value, collector deployment, or collection-gate change.

• Does MDIR improve real audit accuracy at acceptable cost against strong generic traces with independent immutable export?
• Does an independent checkpoint recover detection after a privileged operator rewrite?
• Can reviewer burden and operational overhead stay within the frozen development-gate thresholds?

Builds on Round 19, Round 18, Round 17, Round 13. Continued in Round 22, Round 21.