# Receipt Witness Operator Kit 0.1

**Operator profile:** `bulla.receipt-witness/0.1-experimental`  
**Kit profile:** `bulla.receipt-witness-operator-kit/0.1-experimental`  
**Candidate profile:** `glyph.independent-witness-candidate/0.1`

The kit lets one operator generate its own key, retain exact ActionReceipt
bytes, maintain an append-only Merkle log across restarts, explicitly issue
operator-signed checkpoints, serve read-only retrieval and proof endpoints, and
export a closed candidate without serializing the private key file. The
exporter rejects direct encodings of its operator seed and private-key field
names; it cannot establish the absence of transformed secrets in operator-authored
disclosures.

A locally valid candidate establishes only that the submitted package is
internally closed and operator-authentic under its did:key. It is
`VALID_CANDIDATE · NOT_COUNTED`. External organizational control, legal control,
key custody, operational authority, relationship to Glyph, and stable endpoint
operation are separately reviewed before W can change.

W counts unique qualified control domains, not keys, logs, endpoints, or
packages. Running supplied code can never increment independent
implementations, external reliance decisions, or external replays.

The profile does not establish receipt truth, occurrence, current or future
availability, privacy-policy performance, production fitness, capital,
recourse, settlement, decentralization, or a witness market.
