They wanted the artifact.
Not the outcome. Not the state. The artifact.
A thing you can staple to a ticket so the thread stops vibrating. A “certificate.” A “receipt.” Some exportable object with a filename that makes other systems stop asking questions.
On Dusk Foundation, that request hits a wall that doesn’t look like a wall.
The transition already landed. In-window. Final. DuskVM ran it under the execution context the committee had in force at that moment. Weight crossed when it needed to. The attestation exists. Moonlight resolved it to the viewer set that was entitled at execution.
Then the downstream stack shows up late, asking for a comfort object that was never in the deal.
“Attach the proof.”
Which proof. For which viewers. In what scope.
Nobody says those words at first. They talk like they always do.
“Can we export the cert?” “Is there a proof file?” “Where’s the receipt for this transition?”
There’s a pause that doesn’t feel technical. It feels political.
Because the proof is real. It’s just not portable in the way their ticket system expects. On Dusk, the comfort object isn’t a default deliverable. The attestation isn’t minted as a little file designed to survive forwarding. It resolves inside disclosure rules.
If you’re in the viewer set, it’s boring. Open it. Verify it. Done.
If you’re not, it’s not “permission denied.” It’s worse: it doesn’t resolve at all. Same reference. Same hash. Blank.
Someone tries anyway. Drops the reference into chat, like the hash itself will force reality to line up.
Ops: “Doesn’t open.” Legal: “It opens.” Finance: “Just give me the number.” Risk: “Put it in the case.”
You can feel the mismatch in the typing.
A reply starts: “It’s scoped,” gets deleted, then rewritten as: “We can’t share.”
That’s when the bad suggestions arrive, one after another, because they always do when people smell a blocked workflow.
“Screenshot it.” Deleted fast.
“Redact it. Minimal fields.” Minimal for who.
Because the moment you create a new artifact meant to be forwarded, you’re not just formatting. You’re changing who can see. You’re turning a Dusk's scoped disclosure into a portable object that can cross departments, inboxes, vendors, whatever else your stack quietly talks to.
Dusk's Secure transaction settlement lane Moonlight doesn’t do “portable by default.” Dusk doesn’t mint a receipt that upgrades unauthorized viewers into authorized ones after the state already moved. The viewer set was part of what got enforced at execution. You don’t get to widen it because a ticket template has an empty slot.
So the request keeps coming back, rephrased softer each time, like softer words are safer.
“Just something we can store.” “Just something that proves it happened.” “Just something we can send to the other team.”
Proves to whom is the sentence that kills the room.
Because “the other team” is the exact problem. They weren’t in the viewer set when Dusk committee weight ratified the transition. They weren’t supposed to be. If they were supposed to be, you would have designed that viewer scoping into the execution path up front.
Nobody wants to admit the ask is basically: “Can Dusk mint a new object so our internal silos feel like one audience?”
Dusk doesn’t recognize silos as a scope primitive. It recognizes viewers.
Nothing breaks. Monitoring stays green. Other transitions keep finalizing. The chain looks healthy. The only thing “wrong” is that the downstream machine refuses to accept scoped truth unless it can turn it into an attachment it’s allowed to spray around.
So the workaround becomes human and slightly ugly.
An authorized person opens the Moonlight view. Reads the attestation. Hesitates on the copy button like it’s a trap. Doesn’t paste. Doesn’t forward. Types a thinner line instead.
“Confirmed in-scope.” “State finalized.” “Timestamp + reference.”
Finance replies: “Need the receipt.” Ops replies: “Ticket requires attachment.” Risk replies: “Upload the cert.”
The authorized person stares at the cursor. Because the cert they want is the cert they aren’t entitled to forward.
The bot pings again two minutes later.
“Waiting on artifact.”
No one answers immediately.
Someone starts rewriting the safe summary because one adjective sounds too specific. Someone else asks—again—if there’s a “proper receipt export,” like asking politely might make DuskVM mint a different shape of truth.
The state is final.
The viewer scope isn’t.
And the attachment field stays empty long enough that the downstream systems start treating “final” as suspicious, because they never got the comfort object they’ve trained themselves to trust.