Institutional
Decision Platform

Section 02//Layers

The two layers do not overlap. Ink Receipts holds the evidence primitives. BAINK holds workflows, accounts, and integrations.

Section 03//Structure

The workspace mirrors the layer split. The dependency direction is one-way: BAINK depends on Ink Receipts; the kernel knows nothing about BAINK.

workspace/
├── ink-receipts/          // reusable OSS kernel
│   ├── crates/
│   │   ├── ink-core/        // shared types, errors, IDs, traits
│   │   ├── ink-schema/      // decision record schemas
│   │   ├── ink-canonical/   // deterministic JSON canonicalization
│   │   ├── ink-crypto/      // hashing, signing, verification
│   │   ├── ink-bundle/      // receipt bundle structure
│   │   ├── ink-verify/      // verifier engine
│   │   ├── ink-cli/         // `ink` command-line interface
│   │   ├── ink-wasm/        // browser / local verification
│   │   └── ink-ffi/         // bindings for Python / Node
│   └── docs/
│
└── baink/                 // institutional decision platform
    ├── api/
    ├── web/
    ├── integrations/
    ├── registry/
    ├── workflows/
    └── enterprise/

• ink-coreShared types, errors, IDs, traits
• ink-schemaDecision record schemas
• ink-canonicalDeterministic JSON canonicalization
• ink-cryptoHashing, signing, verification primitives
• ink-bundleReceipt bundle structure
• ink-verifyVerifier engine
• ink-cliCommand-line interface (`ink`)
• ink-wasmBrowser / local verification
• ink-ffiBindings for Python, Node, other systems

Section 04//Object Model

Defined in the Ink Receipts kernel. Consumed by BAINK. Records become receipts; receipts go into bundles; bundles produce reports.

#[derive(Debug, Serialize, Deserialize)]
pub struct DecisionRecord {
    pub schema_version: SchemaVersion,
    pub institution: InstitutionId,
    pub workflow: WorkflowId,
    pub decision_id: DecisionId,
    pub timestamp: Timestamp,
    pub subject_ref: SubjectRef,
    pub inputs: Vec<InputRef>,
    pub model_ref: Option<ModelRef>,
    pub policy_ref: PolicyRef,
    pub controls: Vec<ControlAssertion>,
    pub outcome: DecisionOutcome,
}

pub struct InkReceipt {
    pub receipt_version: SchemaVersion,
    pub record_hash: HashDigest,
    pub bundle_hash: HashDigest,
    pub issued_at: Timestamp,
    pub issuer: IssuerId,
    pub signature: Option<SignatureBlock>,
}

pub enum VerificationStatus {
    Pass,      // structurally valid & cryptographically consistent
    Warning,   // valid, but policy or completeness concerns
    Fail,      // invalid, corrupted, mismatched, unverifiable
    Skipped,   // check was not applicable or not configured
}

Section 05//Pipeline

Kernel pipeline. BAINK orchestrates inputs and outputs around it; the transformation itself is fixed.

  raw decision material
            ↓
    DecisionRecord
            ↓
    canonical JSON
            ↓
        hash
            ↓
      InkReceipt
            ↓
   EvidenceBundle
            ↓
        verify
            ↓
 VerificationReport

Section 06//Runtime

A single binary, ink. No daemon, no service, no network calls. The verifier is deterministic — anyone with the bundle can reproduce the report.

• ink initScaffold a record skeleton
• ink hash record.jsonCanonicalize and hash
• ink receipt record.jsonIssue an unsigned local InkReceipt
• ink bundle record.json --out bundle.ink.jsonPack record + receipt
• ink verify bundle.ink.jsonRun the deterministic verifier
• ink report bundle.ink.json --format markdownRender verifier output

BAINK wraps these primitives in workflows; the ink CLI is the bare kernel surface.