Receipts & proof

A successful paid call produces three artifacts: a signed receipt, an audit-chain entry, and a downloadable proof bundle the agent's principal can verify offline.

Signed receipts

Receipts are signed via a Signer port. The production signer loads an Ed25519 key from a secret manager (the envmode); ephemeral signers are refused in production without an explicit override. A KMS/HSM-backed signer is a follow-on (AWS KMS does not support Ed25519).

• Ed25519-signed receipts shipped
• Secret-manager Ed25519 signer in production (env mode) shipped
• Signing-key rotation with historical verify shipped

Receipt shape

{
  "schemaVersion": "agenttrust.receipt.v1",
  "receiptId": "rcp_<placeholder>",
  "providerId": "prv_<placeholder>",
  "requestSha256": "<sha256>",
  "agentDid": "did:web:<placeholder>",
  "principalId": "<placeholder>",
  "paid": true,
  "facilitator": "sandbox",
  "signature": "<ed25519>",
  "signingKeyId": "gw-ed25519-<id>"
}

Proof bundles

A proof bundle is a downloadable artifact that contains the receipt, the per-provider audit-log hash-chain proof, and the verifier's manifest. Customers run pnpm proof:verify <bundle>to verify offline.

• Offline proof verifier (pnpm proof:verify) shipped
• Audit-log hash chain, per provider shipped
• Per-receipt hash chain (signed prevReceiptHash), offline-verifiable shipped
• Bundle signature over manifest shipped

$ pnpm proof:verify ./bundle-12af34.zip
{
  "schemaVersion": "agenttrust.proof_bundle.v1",
  "verdict": "valid",
  "receiptCount": 2,
  "hashChainContinuous": true,
  "signaturesValid": true
}

Hash chain

Receipts are Ed25519-signed and offline-verifiable. Each receipt also links to its provider's previous receipt: prevReceiptHashis part of the signed body, so the per-receipt chain is both tamper-evident and signature-protected. Walk it offline against the gateway's published public key via GET /v1/providers/{id}/receipt-chain.

Separately, the audit log is hash-chained per provider: every audit event commits to its predecessor's hash, so tampering breaks the chain. A proof bundle carries the signed receipt and the audit-chain proof. Verification is offline.

Boundaries

• The receipt body is sha256-hashed by default; raw bodies are not retained unless the merchant opts in.
• Public verification depends on the gateway's published Ed25519 public key. Key rotation preserves historical verify.
• Proof bundle is generated on demand; it is not pushed to a registry.