POPCORN · checkpoint evidence

Show the receipt. Show the work.

The executor checks the proposed action before it takes effect. The mirror displays the resulting evidence.

Read-only evidence viewer. Open a saved bundle to see its authorization, witnesses, and executor receipt. The caller workflow verifies the evidence; the executor enforces the action.

The four checks

1. What time is it?Grounded time, with its source and uncertainty stated.
2. Is this receipt real?The signature verifies against the trusted key.
3. Am I who it says I am?The identity binds to the presenter.
4. Am I in the window?Scope, clock, and cost hold for the exact action.

The executor enforces STOP or PROCEED. It checks that the authorization is still active at the resource: a revoked or already used grant stops the action. Missing parameters stop the flow with “incomplete, need X.” Receipts are evidence; they never grant permission.

One action, retained evidence

Registered authorization → pre-action witness → executor's signed result → linked post-commit witness

The witnesses keep their native protocol labels. POPCORN uses the platform wall clock with an asserted accuracy radius. It is not an RFC 3161 timestamp authority and does not prove external atomic-clock alignment. A policy requiring measured accuracy closes the gate.