diff --git a/.github/workflows/model-plane-receipts.yml b/.github/workflows/model-plane-receipts.yml
new file mode 100644
index 0000000..b1cb851
--- /dev/null
+++ b/.github/workflows/model-plane-receipts.yml
@@ -0,0 +1,48 @@
+name: model-plane-receipts
+
+# Teeth for the Model Plane (Tranche 7) receipt emitter shim: proves source-os emits
+# spec-conformant, hash-chained InferenceReceipts and that tampered / local-only receipts
+# are rejected (SEAM-011). CI needs no model — the emitter path is what is under test.
+
+on:
+  pull_request:
+    paths:
+      - 'modules/model-plane/**'
+      - '.github/workflows/model-plane-receipts.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'modules/model-plane/**'
+      - '.github/workflows/model-plane-receipts.yml'
+
+jobs:
+  inferenced-receipt-teeth:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install jsonschema
+        run: python -m pip install --quiet 'jsonschema>=4.22,<5'
+
+      - name: Assert emitter is vendored byte-verbatim (consume-not-fork)
+        run: |
+          set -euo pipefail
+          expected=6881246b8e41a515fb1b29df645faeb9be17d8195d22a7e0d5ce15f8477d8e6a
+          actual=$(sha256sum modules/model-plane/tools/inference_receipt_emitter.py | awk '{print $1}')
+          if [ "$actual" != "$expected" ]; then
+            echo "ERR: vendored emitter diverged from canonical (expected $expected, got $actual)."
+            echo "     Refresh from prophet-platform apps/receipt-gateway; do not fork (SEAM-011)."
+            exit 1
+          fi
+          echo "OK: emitter matches canonical sha256:$expected"
+
+      - name: inferenced emit-shim teeth
+        run: python modules/model-plane/inferenced_shim.py --selftest
+
+      - name: Canonical emitter self-test
+        run: python modules/model-plane/tools/inference_receipt_emitter.py --selftest
diff --git a/docs/model-plane/architecture.md b/docs/model-plane/architecture.md
new file mode 100644
index 0000000..a2d63d7
--- /dev/null
+++ b/docs/model-plane/architecture.md
@@ -0,0 +1,47 @@
+# Model Plane on source-os (Tranche 7)
+
+The Model Plane is source-os's tiered, on-device inference substrate: placement tiers
+**T0–T4** where a tier boundary *is* a data-residency boundary, with provenance receipts,
+consent-gated escalation, and governed distillation. The canonical contracts are owned by
+`SourceOS-Linux/sourceos-spec` (Tranche 7); source-os is a downstream **emitter**.
+
+## Status
+
+This directory currently ships the **emitter shim** for the serving path — the smallest
+real slice that proves source-os can emit a spec-conformant, hash-chained
+`InferenceReceipt` natively. The full daemon set is not yet built.
+
+| Slice | Item | State |
+|-------|------|-------|
+| T7-9  | `docs/model-plane/architecture.md` | this stub |
+| T7-10 | `profiles/model-plane/{constrained,standard,workstation,cluster-node}.nix` | not built |
+| T7-11 | `modules/modelplaned/` (catalog + residency) | not built |
+| T7-12 | `modules/inferenced/` (serving) | **emitter shim only** (`modules/model-plane/inferenced_shim.py`) |
+| T7-13 | `modules/embeddingd/` | not built |
+| T7-14 | `modules/visiond/` (no network namespace) | not built |
+| T7-15 | `modules/distilld/` (governed distillation) | not built |
+| T7-20 | `docs/seam-registry.md` — SEAM-014..017 | not built |
+
+Everything not built here is tracked in the T7 follow-up issue.
+
+## Receipt spine (SEAM-011)
+
+Every completion a serving daemon finishes must leave an `InferenceReceipt` in the estate's
+single **hash-chained** ledger — a local-only ledger is not permitted (SEAM-011). source-os
+**consumes** the canonical emitter (`prophet-platform apps/receipt-gateway`,
+vendored byte-verbatim under `modules/model-plane/tools/`); it does not re-implement the
+chain. `modules/model-plane/inferenced_shim.py` is the serving-path caller: given the
+content-addressed base-model digest and the input/output of a finished completion, it
+appends an on-device receipt via the vendored `emit_receipt()`.
+
+Teeth (`.github/workflows/model-plane-receipts.yml`): a produced receipt validates against
+`InferenceReceipt.schema.json` and chains (prevHash continuity); a tampered entry and a
+local-only (unchained) entry are both rejected; and the vendored emitter is asserted to
+match the canonical sha256 (consume-not-fork guard).
+
+## Off-device escalation
+
+An on-device (`on_device_only`) completion carries no lease and no escalation. A completion
+served off-device (`sovereign_cluster` / `external_permitted`) crosses a data boundary and
+must carry an authorizing capability lease and a non-empty escalation chain (SEAM-015);
+the schema enforces this. Off-device serving is out of scope for the emitter shim.
diff --git a/modules/model-plane/__pycache__/inferenced_shim.cpython-312.pyc b/modules/model-plane/__pycache__/inferenced_shim.cpython-312.pyc
new file mode 100644
index 0000000..c496b81
Binary files /dev/null and b/modules/model-plane/__pycache__/inferenced_shim.cpython-312.pyc differ
diff --git a/modules/model-plane/inferenced_shim.py b/modules/model-plane/inferenced_shim.py
new file mode 100755
index 0000000..9cf7e28
--- /dev/null
+++ b/modules/model-plane/inferenced_shim.py
@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""`inferenced` receipt-emission shim (Model Plane, Tranche 7 — emitter half of T7-12).
+
+The full `inferenced` serving daemon (T7-12) is not built here (it is blocker-laden:
+HellGraph ledger service, base-model licensing, credentials). This shim is the SMALLEST
+real slice that proves source-os can emit a spec-conformant, hash-chained
+`InferenceReceipt` NATIVELY when a completion finishes: it takes the facts a real serving
+daemon has at completion time (the content-addressed base-model digest, the task, and the
+input/output) and appends an on-device receipt to the estate's hash-chained ledger
+(SEAM-011: no local-only ledger).
+
+Consume-not-fork: all chaining/canonicalisation/verification is delegated to the vendored
+canonical emitter (tools/inference_receipt_emitter.py, byte-verbatim from
+prophet-platform apps/receipt-gateway). This file adds no chain logic of its own.
+
+CLI:
+  inferenced_shim.py --ledger <path> --base-model-digest sha256:<64hex> \
+                     --task <label> --input-file <f> --output-file <f>
+  inferenced_shim.py --selftest    # emits + verifies a synthetic chain (labelled synthetic)
+
+exit 0 ok; 1 conformance/chain failure; 2 usage/dependency error.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE / "tools"))
+
+try:
+    import jsonschema
+except ImportError:
+    print("ERR: jsonschema not installed", file=sys.stderr)
+    raise SystemExit(2)
+
+from inference_receipt_emitter import (  # noqa: E402
+    SCHEMA, canonical, emit_receipt, sha256, verify_ledger,
+)
+
+
+def _validator() -> "jsonschema.Draft202012Validator":
+    schema = json.loads(SCHEMA.read_text(encoding="utf-8"))
+    jsonschema.Draft202012Validator.check_schema(schema)
+    return jsonschema.Draft202012Validator(schema)
+
+
+def emit_completion_receipt(ledger: Path, *, base_model_digest: str, task: str,
+                            input_text: str, output_text: str,
+                            compute_device: str = "cpu") -> dict:
+    """Emit one on-device InferenceReceipt for a finished completion (delegates to canonical)."""
+    return emit_receipt(
+        ledger, base_model_digest=base_model_digest, task=task,
+        input_text=input_text, output_text=output_text,
+        provider_daemon="inferenced", tier="T1", compute_device=compute_device,
+    )
+
+
+def _selftest() -> int:
+    """Teeth: emit a synthetic chain, prove conformance + chaining, and prove the chain
+    rejects a tampered entry and a local-only (unchained) entry. The completions are
+    LABELLED SYNTHETIC — no model runs here; this proves the emitter path, not an LLM run."""
+    validator = _validator()
+    digest = "sha256:" + "a" * 64
+    with tempfile.TemporaryDirectory() as d:
+        ledger = Path(d) / "inference-ledger.jsonl"
+        for i in range(3):
+            r = emit_completion_receipt(
+                ledger, base_model_digest=digest, task="selftest",
+                input_text=f"synthetic prompt {i}", output_text=f"synthetic completion {i}")
+            if list(validator.iter_errors(r)):
+                print(f"FAIL: emitted receipt {i} schema-invalid", file=sys.stderr)
+                return 1
+        ok, msg = verify_ledger(ledger, validator)
+        if not ok:
+            print(f"FAIL: chain should be valid: {msg}", file=sys.stderr)
+            return 1
+        print(f"OK conformance+chain: {msg}")
+
+        # Tamper -> chain breaks.
+        lines = ledger.read_text(encoding="utf-8").splitlines()
+        e1 = json.loads(lines[1]); e1["outputHash"] = sha256("tampered")
+        lines[1] = canonical(e1)
+        ledger.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        if verify_ledger(ledger, validator)[0]:
+            print("FAIL: tamper not detected — chain has no teeth", file=sys.stderr)
+            return 1
+        print("OK tamper-evidence: mutation detected")
+
+    # Local-only (unchained, seq>=1 without ledgerPrevHash) rejected by schema + verifier.
+    with tempfile.TemporaryDirectory() as d:
+        ledger = Path(d) / "local-only.jsonl"
+        base = emit_completion_receipt(ledger, base_model_digest=digest, task="t",
+                                       input_text="a", output_text="b")
+        local_only = dict(base); local_only["ledgerSeq"] = 1
+        local_only.pop("ledgerPrevHash", None)
+        if not list(validator.iter_errors(local_only)):
+            print("FAIL: schema accepted a local-only (unchained) entry", file=sys.stderr)
+            return 1
+        with ledger.open("a", encoding="utf-8") as f:
+            f.write(canonical(local_only) + "\n")
+        if verify_ledger(ledger, validator)[0]:
+            print("FAIL: verifier accepted a local-only entry (SEAM-011 hole)", file=sys.stderr)
+            return 1
+        print("OK local-only rejected: schema + verifier both refuse an unchained entry")
+
+    print("PASS: inferenced emit-shim teeth all bite")
+    return 0
+
+
+def main(argv: list[str]) -> int:
+    ap = argparse.ArgumentParser(description="inferenced InferenceReceipt emit shim")
+    ap.add_argument("--selftest", action="store_true")
+    ap.add_argument("--ledger", type=Path)
+    ap.add_argument("--base-model-digest")
+    ap.add_argument("--task")
+    ap.add_argument("--input-file", type=Path)
+    ap.add_argument("--output-file", type=Path)
+    ap.add_argument("--compute-device", default="cpu")
+    args = ap.parse_args(argv[1:])
+
+    if args.selftest:
+        return _selftest()
+
+    missing = [n for n, v in (("--ledger", args.ledger), ("--base-model-digest", args.base_model_digest),
+                              ("--task", args.task), ("--input-file", args.input_file),
+                              ("--output-file", args.output_file)) if v is None]
+    if missing:
+        print(f"ERR: missing required args: {', '.join(missing)}", file=sys.stderr)
+        return 2
+    r = emit_completion_receipt(
+        args.ledger, base_model_digest=args.base_model_digest, task=args.task,
+        input_text=args.input_file.read_text(encoding="utf-8"),
+        output_text=args.output_file.read_text(encoding="utf-8"),
+        compute_device=args.compute_device)
+    print(json.dumps(r, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))
diff --git a/modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json b/modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json
new file mode 100644
index 0000000..63a3716
--- /dev/null
+++ b/modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json
@@ -0,0 +1,361 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.srcos.ai/v2/InferenceReceipt.json",
+  "$comment": "VENDORED VERBATIM (do not edit) from SocioProphet/prophet-platform apps/receipt-gateway/schemas/model-plane/InferenceReceipt.schema.json @ commit abd98805, sha256:3d4c2a55070d65dbc902ba0880ea61c9ae6cbbca2b675c559a01a18a8b734499. Canonical owner: SourceOS-Linux/sourceos-spec (Tranche 7). Refresh via cp; do not diverge (SEAM-011).",
+  "title": "InferenceReceipt",
+  "description": "VENDORED from SourceOS-Linux/sourceos-spec (Tranche 7, canonical owner). Provenance receipt emitted for every model-plane completion (Tranche 7 / Model Plane). Identifies the tier, the content-addressed base model / adapter / tokenizer digests, the serving daemon and provider, the data-residency class the request was served under, and the escalation chain if any. This is the provenance primitive that makes on-device inference auditable: it references the existing Model Carry family (InferenceProvider, ModelResidency, SourceOSModelCarryRef) rather than restating it. Receipts are ledger-bound; a local-only ledger is not permitted (SEAM-011).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id",
+    "type",
+    "specVersion",
+    "issuedAt",
+    "providerDaemon",
+    "tier",
+    "baseModelDigest",
+    "task",
+    "inputHash",
+    "outputHash",
+    "dataResidencyClass",
+    "ledgerSeq"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^urn:srcos:inference-receipt:",
+      "description": "Stable URN identifier. Pattern: urn:srcos:inference-receipt:<local-id>"
+    },
+    "type": {
+      "const": "InferenceReceipt",
+      "description": "Discriminator constant \u2014 always \"InferenceReceipt\"."
+    },
+    "specVersion": {
+      "type": "string",
+      "description": "Spec version of this document, e.g. \"2.1.0\"."
+    },
+    "issuedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "Timestamp when the completion finished and the receipt was issued."
+    },
+    "requestingAgentRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:agent-passport:",
+      "description": "AgentPassport URN of the agent that requested the inference. Null only for internal system-initiated inference."
+    },
+    "requestingAgentClass": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "system_core",
+        "intelligence_automation",
+        "app_helper",
+        "legacy_bridge",
+        "third_party",
+        null
+      ],
+      "description": "Mirror of the requesting agent's AgentPassport.agent_class, for at-a-glance audit. Authoritative source is the referenced passport."
+    },
+    "capabilityLeaseRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:lease:",
+      "description": "AgentCapabilityLease URN authorizing this provider connection. Null is only valid for on_device_only T0 system inference; any non-on_device_only receipt MUST carry a lease (enforced below)."
+    },
+    "providerDaemon": {
+      "type": "string",
+      "enum": [
+        "inferenced",
+        "embeddingd",
+        "visiond",
+        "distilld"
+      ],
+      "description": "The model-plane serving daemon that produced this completion. Note: modelplaned is a catalog authority and does not perform inference, so it never emits an InferenceReceipt."
+    },
+    "providerRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:inference-provider:",
+      "description": "InferenceProvider URN backing the serving daemon."
+    },
+    "tier": {
+      "type": "string",
+      "enum": [
+        "T0",
+        "T1",
+        "T2",
+        "T3",
+        "T4"
+      ],
+      "description": "Placement tier that served the request. Tier boundaries are data-residency boundaries (Model Plane \u00a7II)."
+    },
+    "baseModelDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Content-addressed digest of the base model weights that served the request."
+    },
+    "adapterDigest": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Content-addressed digest of the active LoRA adapter, or null when the base model served the request with no adapter."
+    },
+    "tokenizerDigest": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Content-addressed digest of the tokenizer used."
+    },
+    "modelCarryRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:model-carry-ref:",
+      "description": "SourceOSModelCarryRef URN under which the model was carried/authorized."
+    },
+    "modelResidencyRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:model-residency:",
+      "description": "ModelResidency URN observed at serving time."
+    },
+    "task": {
+      "type": "string",
+      "description": "Task label the request was routed as, e.g. summarization, embedding, agent_classification, ocr-recognize."
+    },
+    "inputHash": {
+      "type": "string",
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Hash of the canonical input. The receipt records that an inference occurred and over what, not the content."
+    },
+    "inputTokenCount": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "minimum": 0,
+      "description": "Input token count, or null for non-text modalities."
+    },
+    "outputHash": {
+      "type": "string",
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Hash of the canonical output."
+    },
+    "outputTokenCount": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "minimum": 0,
+      "description": "Output token count, or null for non-text modalities."
+    },
+    "confidence": {
+      "type": [
+        "number",
+        "null"
+      ],
+      "minimum": 0,
+      "maximum": 1,
+      "description": "Model-reported confidence used for the escalation trigger, or null when not estimated."
+    },
+    "confidenceMethod": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "logit-entropy",
+        "verbalized",
+        "calibration-head",
+        "downstream-validation",
+        "none",
+        null
+      ],
+      "description": "How `confidence` was derived. REVIEW HARDENING (Model Plane OQ1 / finding: confidence is the load-bearing escalation gate and is self-reported): recording the method makes the number auditable and lets downstream calibration checks run. A null method with a non-null confidence should be treated as uncalibrated."
+    },
+    "latencyMs": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "minimum": 0,
+      "description": "End-to-end serving latency in milliseconds."
+    },
+    "escalatedFrom": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "T0",
+        "T1",
+        "T2",
+        "T3",
+        null
+      ],
+      "description": "The tier this request was escalated FROM, or null if served at first placement. Must be null when dataResidencyClass is on_device_only (enforced below)."
+    },
+    "escalationChain": {
+      "type": "array",
+      "description": "Ordered EscalationDecision URNs recording each tier/residency boundary this request crossed. Empty when served at first placement.",
+      "items": {
+        "type": "string",
+        "pattern": "^urn:srcos:escalation-decision:"
+      }
+    },
+    "dataResidencyClass": {
+      "type": "string",
+      "enum": [
+        "on_device_only",
+        "sovereign_cluster",
+        "external_permitted"
+      ],
+      "description": "The residency class this completion was served under. Any class other than on_device_only means the input crossed a data boundary and MUST be accompanied by a lease and a non-empty escalation chain (enforced below; SEAM-015)."
+    },
+    "computeDevice": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "ane",
+        "gpu",
+        "cpu",
+        "npu",
+        "remote",
+        null
+      ],
+      "description": "Hardware path that executed the compute."
+    },
+    "ledgerSeq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Monotonic sequence number of this receipt in the append-only ledger."
+    },
+    "ledgerPrevHash": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "REVIEW HARDENING (finding: the ledger is the trust anchor for every Model Plane provenance claim but `ledgerSeq` alone does not bind entry N to N-1). Hash of the prior ledger entry, making the ledger tamper-evident/hash-chained so an enumerated contribution list cannot be retroactively rewritten."
+    },
+    "evidenceHash": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Hash of the canonical receipt evidence payload."
+    },
+    "evidenceRefs": {
+      "type": "array",
+      "description": "Additional evidence URNs or content hashes.",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "allOf": [
+    {
+      "$comment": "SEAM-015: a completion served off-device (not on_device_only) must carry both an authorizing capability lease and a non-empty escalation chain. Possession of the output is not authorization for the crossing.",
+      "if": {
+        "properties": {
+          "dataResidencyClass": {
+            "enum": [
+              "sovereign_cluster",
+              "external_permitted"
+            ]
+          }
+        },
+        "required": [
+          "dataResidencyClass"
+        ]
+      },
+      "then": {
+        "required": [
+          "capabilityLeaseRef",
+          "escalatedFrom",
+          "escalationChain"
+        ],
+        "properties": {
+          "capabilityLeaseRef": {
+            "type": "string"
+          },
+          "escalatedFrom": {
+            "type": "string",
+            "enum": [
+              "T0",
+              "T1",
+              "T2",
+              "T3"
+            ]
+          },
+          "escalationChain": {
+            "minItems": 1
+          }
+        }
+      }
+    },
+    {
+      "$comment": "An on_device_only completion cannot have been escalated from a lower tier.",
+      "if": {
+        "properties": {
+          "dataResidencyClass": {
+            "const": "on_device_only"
+          }
+        },
+        "required": [
+          "dataResidencyClass"
+        ]
+      },
+      "then": {
+        "properties": {
+          "escalatedFrom": {
+            "const": null
+          }
+        }
+      }
+    },
+    {
+      "$comment": "REVIEW HARDENING (ledger tamper-evidence): any non-genesis entry (ledgerSeq >= 1) must carry the prior entry's hash, so the append-only ledger is hash-chained and an enumerated contribution list cannot be retroactively rewritten.",
+      "if": {
+        "properties": {
+          "ledgerSeq": {
+            "minimum": 1
+          }
+        },
+        "required": [
+          "ledgerSeq"
+        ]
+      },
+      "then": {
+        "required": [
+          "ledgerPrevHash"
+        ],
+        "properties": {
+          "ledgerPrevHash": {
+            "type": "string"
+          }
+        }
+      }
+    }
+  ]
+}
diff --git a/modules/model-plane/tools/VENDOR.md b/modules/model-plane/tools/VENDOR.md
new file mode 100644
index 0000000..7430b65
--- /dev/null
+++ b/modules/model-plane/tools/VENDOR.md
@@ -0,0 +1,27 @@
+# Vendored: InferenceReceipt emitter
+
+`inference_receipt_emitter.py` in this directory is **vendored byte-verbatim** (do not
+edit) from the canonical emitter:
+
+- Source: `SocioProphet/prophet-platform` — `apps/receipt-gateway/tools/inference_receipt_emitter.py`
+- Pinned commit: `abd98805`
+- Source sha256: `6881246b8e41a515fb1b29df645faeb9be17d8195d22a7e0d5ce15f8477d8e6a`
+- Canonical owner of the schema: `SourceOS-Linux/sourceos-spec` (Tranche 7 / Model Plane)
+
+`schemas/model-plane/InferenceReceipt.schema.json` is likewise vendored verbatim (its
+`$comment` records the same provenance).
+
+**Consume-not-fork (SEAM-011):** the hash-chain, canonical-JSON, and ledger logic are
+consumed unchanged so this repo's receipts share one estate spine with the
+receipt-gateway. Refresh by re-copying from prophet-platform; do not diverge. The only
+source-os-specific code is `inferenced_shim.py`, which calls `emit_receipt()` — it does
+not re-implement any chaining.
+
+Refresh command:
+
+```sh
+cp <prophet-platform>/apps/receipt-gateway/tools/inference_receipt_emitter.py \
+   modules/model-plane/tools/inference_receipt_emitter.py
+cp <prophet-platform>/apps/receipt-gateway/schemas/model-plane/InferenceReceipt.schema.json \
+   modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json  # then re-add $comment
+```
diff --git a/modules/model-plane/tools/__pycache__/inference_receipt_emitter.cpython-312.pyc b/modules/model-plane/tools/__pycache__/inference_receipt_emitter.cpython-312.pyc
new file mode 100644
index 0000000..7508040
Binary files /dev/null and b/modules/model-plane/tools/__pycache__/inference_receipt_emitter.cpython-312.pyc differ
diff --git a/modules/model-plane/tools/inference_receipt_emitter.py b/modules/model-plane/tools/inference_receipt_emitter.py
new file mode 100755
index 0000000..ee420ef
--- /dev/null
+++ b/modules/model-plane/tools/inference_receipt_emitter.py
@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""InferenceReceipt emitter + hash-chained ledger (reference implementation).
+
+This is the emitter side of the Model Plane: when an inference completes, it writes a
+schema-conformant, hash-chained InferenceReceipt to an append-only ledger (SEAM-011:
+no local-only ledger; the chain makes it tamper-evident). The receipt/ledger machinery
+is REAL and self-proven here; wiring it to a live model is one call to `emit_receipt`.
+
+HONEST BOUNDARY: no local model runs (no weights present), so `--selftest` exercises the
+emitter with clearly-labelled synthetic completions (task "selftest"). It proves the
+emitter produces conformant receipts and an unbroken, tamper-evident chain — NOT that a
+real LLM completion occurred. Point `emit_receipt` at a real provider to emit real receipts.
+
+exit 0 ok; 1 = conformance/chain failure; 2 = usage error.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from collections import deque
+from datetime import datetime, timezone
+from pathlib import Path
+
+try:
+    import fcntl  # POSIX advisory locking (Linux/macOS)
+except ImportError:  # pragma: no cover
+    fcntl = None
+
+try:
+    import jsonschema
+except ImportError:
+    print("ERR: jsonschema not installed", file=sys.stderr)
+    sys.exit(2)
+
+ROOT = Path(__file__).resolve().parents[1]
+SCHEMA = ROOT / "schemas" / "model-plane" / "InferenceReceipt.schema.json"
+
+_UNSET = object()  # distinguishes "estimate it" from an explicit None (record null)
+
+
+def sha256(s: str) -> str:
+    return "sha256:" + hashlib.sha256(s.encode("utf-8")).hexdigest()
+
+
+def canonical(obj: dict) -> str:
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"))
+
+
+def _last_entry(f) -> dict | None:
+    """Last non-blank ledger entry, constant memory (deque(maxlen=1) over the file)."""
+    f.seek(0)
+    tail = deque((line for line in f if line.strip()), maxlen=1)
+    return json.loads(tail[0]) if tail else None
+
+
+def emit_receipt(ledger: Path, *, base_model_digest: str, task: str, input_text: str,
+                 output_text: str, provider_daemon: str = "inferenced", tier: str = "T1",
+                 tokenizer_digest: str | None = None, compute_device: str = "cpu",
+                 input_token_count=_UNSET, output_token_count=_UNSET) -> dict:
+    """Append one on-device InferenceReceipt to the hash-chained ledger, return it.
+
+    Read-tail + append happen under an exclusive advisory lock so concurrent emitters
+    cannot race into duplicate ledgerSeq or a broken chain (single-writer per entry).
+    """
+    ledger.parent.mkdir(parents=True, exist_ok=True)
+    with ledger.open("a+", encoding="utf-8") as f:
+        if fcntl is not None:
+            fcntl.flock(f, fcntl.LOCK_EX)
+        try:
+            prev = _last_entry(f)
+            seq = (prev["ledgerSeq"] + 1) if prev else 0
+            receipt = {
+                "id": f"urn:srcos:inference-receipt:{task}-{seq}",
+                "type": "InferenceReceipt",
+                "specVersion": "2.1.0",
+                "issuedAt": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+                "providerDaemon": provider_daemon,
+                "tier": tier,
+                "baseModelDigest": base_model_digest,
+                "tokenizerDigest": tokenizer_digest,
+                "task": task,
+                "inputHash": sha256(input_text),
+                # real provider token counts when supplied; explicit None -> null (e.g.
+                # embeddings have no output tokens); _UNSET -> a whitespace estimate.
+                "inputTokenCount": len(input_text.split()) if input_token_count is _UNSET else input_token_count,
+                "outputHash": sha256(output_text),
+                "outputTokenCount": len(output_text.split()) if output_token_count is _UNSET else output_token_count,
+                "dataResidencyClass": "on_device_only",
+                "escalatedFrom": None,
+                "escalationChain": [],
+                "computeDevice": compute_device,
+                "ledgerSeq": seq,
+            }
+            if seq >= 1:
+                # hash-chain: bind this entry to the canonical prior entry (SEAM-011)
+                receipt["ledgerPrevHash"] = sha256(canonical(prev))
+            f.write(canonical(receipt) + "\n")
+            f.flush()
+        finally:
+            if fcntl is not None:
+                fcntl.flock(f, fcntl.LOCK_UN)
+    return receipt
+
+
+def verify_ledger(ledger: Path, validator: "jsonschema.Draft202012Validator") -> tuple[bool, str]:
+    if not ledger.exists():
+        return False, f"ledger not found: {ledger}"
+    try:
+        lines = [l for l in ledger.read_text(encoding="utf-8").splitlines() if l.strip()]
+    except OSError as exc:
+        return False, f"cannot read ledger: {exc}"
+    prev = None
+    for i, line in enumerate(lines):
+        try:
+            r = json.loads(line)
+        except json.JSONDecodeError as exc:
+            return False, f"entry {i} is not valid JSON: {exc}"
+        errs = sorted(validator.iter_errors(r), key=lambda e: list(e.path))
+        if errs:
+            return False, f"entry {i} schema-invalid: {errs[0].message}"
+        if r["ledgerSeq"] != i:
+            return False, f"entry {i} has ledgerSeq {r['ledgerSeq']} (expected {i})"
+        if i >= 1:
+            expect = sha256(canonical(prev))
+            if r.get("ledgerPrevHash") != expect:
+                return False, f"entry {i} chain broken: ledgerPrevHash != hash(entry {i-1})"
+        prev = r
+    return True, f"{len(lines)} receipts: schema-conformant + unbroken hash-chain"
+
+
+def _selftest() -> int:
+    import tempfile
+    schema = json.loads(SCHEMA.read_text(encoding="utf-8"))
+    jsonschema.Draft202012Validator.check_schema(schema)
+    validator = jsonschema.Draft202012Validator(schema)
+    # A REAL model content-address (from the local ollama manifest); the completion is
+    # synthetic self-test data — no model is run here.
+    digest = "sha256:aabd4debf0c8f08881923f2c25fc0fdeed24435271c2b3e92c4af36704040dbc"
+    with tempfile.TemporaryDirectory() as d:
+        ledger = Path(d) / "ledger.jsonl"
+        for i in range(3):
+            emit_receipt(ledger, base_model_digest=digest, task="selftest",
+                         input_text=f"selftest prompt {i}", output_text=f"selftest completion {i}")
+        ok, msg = verify_ledger(ledger, validator)
+        if not ok:
+            print(f"FAIL selftest: {msg}", file=sys.stderr)
+            return 1
+        print(f"OK emitter: {msg}")
+        # Tamper-evidence (teeth both ways): mutate entry 1, chain must break.
+        lines = ledger.read_text(encoding="utf-8").splitlines()
+        e1 = json.loads(lines[1]); e1["outputHash"] = sha256("tampered")
+        lines[1] = canonical(e1); ledger.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        ok, msg = verify_ledger(ledger, validator)
+        if ok:
+            print("FAIL selftest: tamper NOT detected — chain has no teeth", file=sys.stderr)
+            return 1
+        print(f"OK tamper-evidence: mutation detected — {msg}")
+    return 0
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) >= 2 and argv[1] == "--selftest":
+        return _selftest()
+    print("usage: inference_receipt_emitter.py --selftest", file=sys.stderr)
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))