Add portable run receipts and deferred export

.changeset/portable-run-receipts.md

@@ -0,0 +1,6 @@
+---
+"@operatorstack/yield": minor
+---
+
+Add portable privacy-safe run receipts, durable local materialization, deferred
+command-sink export, retry status, and local receipt reports.

README.md

@@ -264,6 +264,11 @@ compatibility aliases for `yskill helper install`.
 3. The coding agent, user, or CLI supplies the result.
 4. Yield resumes from the journal and replays the program to the next operation.
 
+At each stopping point, Yield also stores a privacy-safe portable receipt from
+the exact journal prefix. Receipt export is deferred and never adds network
+work to foreground execution. See
+[portable run receipts](https://github.com/operatorstack/yield/blob/main/docs/reference/run-receipts.md).
+
 If replay produces a different operation, the run fails instead of silently
 forking. Every side effect crosses one of these primitives:
 
@@ -300,7 +305,8 @@ Run `yskill agents` to inspect the pinned registry and available project paths.
 
 Yield provides deterministic control flow, typed requests and responses,
 persistent run state, replay with divergence detection, stale and duplicate
-response rejection, and evidence-bound completion.
+response rejection, evidence-bound completion, and deterministic local run
+receipts with independent retryable export.
 
 Schema validity is not truth. Yield cannot prove that an agent performed only
 the requested work. `runCommand` is different: the Yield CLI executes the

cmd/yskill/bootstrap.go

@@ -273,6 +273,8 @@ func bootstrapOperations(plan bootstrapPlan) []bootstrapOperation {
 		operations = append(operations, bootstrapOperation{kind: bootstrapOperationCommand, dir: plan.SkillDir, name: "npm", args: []string{"install", "--ignore-scripts", "--no-audit", "--no-fund"}})
 	case "go":
 		operations = append(operations, bootstrapOperation{kind: bootstrapOperationCommand, dir: plan.SkillDir, name: "go", args: []string{"mod", "tidy"}})
+	case "rust":
+		operations = append(operations, bootstrapOperation{kind: bootstrapOperationCommand, dir: plan.SkillDir, name: "cargo", args: []string{"generate-lockfile"}})
 	}
 	operations = append(operations,
 		bootstrapOperation{kind: bootstrapOperationDoctor},

cmd/yskill/bootstrap_test.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -67,6 +68,13 @@ func TestBootstrapDryRunDoesNotWrite(t *testing.T) {
 	}
 }
 
+func TestRustBootstrapGeneratesLockBeforeDoctor(t *testing.T) {
+	operations := bootstrapOperations(bootstrapPlan{Language: "rust", SkillDir: "skills/helper"})
+	if len(operations) < 2 || operations[0].kind != bootstrapOperationCommand || operations[0].name != "cargo" || !reflect.DeepEqual(operations[0].args, []string{"generate-lockfile"}) || operations[1].kind != bootstrapOperationDoctor {
+		t.Fatalf("rust bootstrap operations = %+v", operations)
+	}
+}
+
 func TestHelperInstallUsesBootstrapContract(t *testing.T) {
 	withBootstrapTestState(t)
 	root := t.TempDir()
@@ -448,6 +456,8 @@ func TestBuilderModeFixturesAcrossLanguages(t *testing.T) {
 				t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
 			case "go":
 				runTestCommand(t, dir, "go", "mod", "tidy")
+			case "rust":
+				runTestCommand(t, dir, "cargo", "generate-lockfile")
 			}
 			if language == "go" || language == "rust" {
 				runtimePath := localRuntimePath(root)