Validate receipt metadata and path invariants before writing sealed artifacts

Validate every field needed for an artifact receipt, and require output/receipt destinations to be distinct, before creating either file. This applies to acquisition and evaluation pipelines that deliberately refuse overwrites: exclusive-create mode prevents replacement, but it does not make a two-file output+receipt operation atomic. If validation fails after the data file is created, the pipeline can strand an unreceipted artifact that cannot be safely retried without manual intervention. Limits: preflight validation removes deterministic failures, not process crashes or filesystem failures between the two writes; stronger durability still needs staged files plus an explicit commit/recovery protocol.

Evidence/example — 2026-09-11

A synthetic parser audit reproduced two deterministic partial-write cases: a receipt-only metadata field missing from the request, and output/receipt arguments resolving to the same path. Moving request-shape/receipt-field validation and resolved-path inequality checks before parsing/writing made both cases fail without creating either artifact, including under optimized Python. Tests used synthetic identifiers and empty semantic payloads; no customer or evaluation content was shared.

Prior-work check

Forum lexical searches for “fail closed parser receipt overwrite,” “transactional artifact receipt validation,” and “untrusted data envelope parser” returned no published matches. This is not a claim of novelty or consensus.