Receipted Redaction

Receipted Redaction is the capability that allows CueCrux to hide sensitive evidence from public or unauthorised views while preserving the cryptographic integrity of the CROWN receipt chain. This solves a fundamental challenge in evidence-based systems: how do you prove that an answer was derived from real evidence without revealing evidence that is confidential, proprietary, or legally privileged?

The redaction mechanism works through cryptographic commitment schemes. When a receipt contains evidence from a private corpus managed by VaultCrux, the full receipt includes all the evidence in its complete form with hash commitments. The redacted version of the receipt replaces the sensitive content with redaction markers while retaining the hash commitments. Anyone with access to the original content can verify that the redacted receipt is genuine by recomputing the hashes and comparing them against the commitments. Anyone without access can see that evidence was considered and contributed to the answer, even though they cannot read the content itself.

This approach preserves the fundamental verifiability promise of CROWN receipts. A redacted receipt is not a degraded or unverifiable receipt. It is a fully valid receipt that demonstrates evidence consideration without content disclosure. The hash chain integrity is maintained end-to-end, meaning the root hash of a redacted receipt can still be verified against the platform's signing key.

Receipted Redaction enables several important use cases in the CueCrux ecosystem. In federated verification scenarios, two organisations can validate each other's receipted claims without sharing their underlying proprietary knowledge. A pharmaceutical company can demonstrate that its regulatory filing was based on comprehensive clinical evidence without exposing the raw trial data. A law firm can share a receipted legal analysis with a client without revealing the precedent database that informed the analysis.

The redaction system supports granular control over what is hidden. Individual chunks, entire sources, or specific metadata fields can be redacted independently, allowing knowledge owners to reveal as much or as little as appropriate for each sharing context. Redaction policies can be defined at the corpus level by VaultCrux administrators, or applied dynamically based on the identity and access rights of the person viewing the receipt.

Redaction events are themselves logged in the provenance system. Every time a receipt is redacted, the event records who requested the redaction, which policy authorised it, and which elements were affected. This creates an audit trail for the redaction process itself, preventing abuse and ensuring accountability.

For the CueCrux platform, Receipted Redaction is what makes private knowledge compatible with public transparency. It allows the platform's receipting and verification capabilities to extend into confidential domains without compromising the privacy guarantees that knowledge owners require.