A document you can re-run — and verify.
An ORP document is structured so each part of the reasoning is separately inspectable and auditable. Assumptions are explicit, so it can be forked and re-run; and it can carry a signature, so it can be checked offline by a person or a machine.
Because assumptions are explicit, anyone can fork a document, change one assumption, and re-run it. Disagreement becomes locatable — you can point to the exact assumption or source where two parties diverge, instead of talking past each other.
A document can carry a cryptographic attestation — a detached Ed25519 signature over its canonical form. A reader (a person, or an agent on a rail) verifies it offline: recompute the hash, check the signature against a key it resolves itself, confirm the key hasn’t expired. No need to trust, or even contact, the publisher.
Verification yields a trust tier —
self_declared → attested → verified → full — and a claimed tier never exceeds what the signatures
prove. For data products, a usage policy then says what may be done, which a rail enforces at
activation.