§receipt

This is the software package. Looking for Axiom's own receipts? axiom.org/receipts

Verifiable custody of agent-produced records

Agents produce records faster than any human can witness them — encoded law, signed rule corpora, release histories. The receipt package writes receipts for those records, and receipt verify is what happens when someone asks to see them: a clone, commodity tools, one offline, fail-closed verdict.

pip install receipt
receipt verify --spec verification/spec.py --commit HEAD

on PyPI as receipt · source at github.com/TheAxiomFoundation/receipt · API reference · Working paper

Try to slip one past it

When an encoding is wrong, the discipline is to fix the pipeline and re-encode — never edit the published file by hand. The record shows which path a change took: pick one below and read the verdict. It is a verdict about the tree the named commit carries, never about whatever a working directory happens to hold.

The corpus exactly as its producer published it: two witnessed releases over three rule files.

the clone

rules/
tax/rate.yaml          value: 0.15
tax/rate.test.yaml
benefit/amount.yaml
.axiom/
toolchain.toml         attested, not content
receipt/
corpus-journal.jsonl   append-only, witnessed
rulespec/compile     outcome: pass
immutable-prefix.json  sealed at genesis
releases/manifests/
0000-a9f4956530a6b22c
.json .producer.sig
.alpha.tsr .beta.tsr
0001-8e2318a7a183ff21
.json .producer.sig
.alpha.tsr .beta.tsr
releases/anchors/
producer-ed25519.pub
alpha-root.pem
beta-root.pem
 
the auditor's own repo — out of the producer's reach
spec.py
producer SPKI 8595923745cbbef6…
two RFC 3161 anchor roots, pinned
sha256 48722e00b717b1b6…

the verdict

$ receipt verify --spec /private/tmp/claude-501/-Users-maxghenis/582ab8c8-c5ec-4f48-8f2c-8cafa7906359/scratchpad/receipt-demo-061/demo/auditor/spec.py --root /private/tmp/claude-501/-Users-maxghenis/582ab8c8-c5ec-4f48-8f2c-8cafa7906359/scratchpad/receipt-demo-061/demo/pristine/corpus --commit HEAD
 
receipt 0.6.1 — receipt test corpus
root  /private/tmp/claude-501/-Users-maxghenis/582ab8c8-c5ec-4f48-8f2c-8cafa7906359/scratchpad/receipt-demo-061/demo/pristine/corpus
commit 324eaab3964f1a8d3aa20ea87d3b4037acade8a9 (tree 0b3400c8e44e864677d731088e0b8dc1bd65a484)
names portable
objects not requested
spec  /private/tmp/claude-501/-Users-maxghenis/582ab8c8-c5ec-4f48-8f2c-8cafa7906359/scratchpad/receipt-demo-061/demo/auditor/spec.py
sha256 48722e00b717b1b6c3a384b836947df63a458c560e7601daff7eefaee8f3a2b2
 
ESTABLISHED OFFLINE, FROM THIS CLONE ALONE
[ok  ] custody
2 release(s), HEAD 0001-8e2318a7a183ff21.json; head 8e2318a7a183ff215d4cc68bdcb189992ce13eaa4f799128a6f1d013938e6c03; producer SPKI 8595923745cbbef6…; anchor set a3021009fb99d91430045c960871842f2b33aa4b99c9c786b38218f30551192a; witnesses alpha 2026-09-10T12:28:49Z · beta 2026-09-10T12:28:49Z
[ok  ] binding
3 content file(s) and 1 attested file(s) match the witnessed journal exactly, closed-world
[ok  ] declaration
3 gate declaration(s) well formed and complete against the loaded spec (1 public, 1 restricted, 1 ci-attested); none re-run here
 
DECLARED IN THE WITNESSED JOURNAL — NOT RE-RUN BY THIS COMMAND
public: you can re-run these yourself from public inputs
- rulespec/compile
restricted: reproducible only with restricted pinned inputs this command cannot obtain
- oracle/licensed-parity
ci-attested: not reproducible; only the CI run's identity vouches
- ci/repository-checks
 
VERDICT: PASS — custody and corpus binding
This proves the published rule files are exactly the bytes the loaded
spec's producer key signed,
and the 2 RFC 3161 authorities configured by that spec (alpha, beta)
witnessed that each recorded prefix existed no later than those times.
Custody is under the anchor set a3021009fb99d91430045c960871842f2b33aa4b99c9c786b38218f30551192a the verified tree carries.
It does NOT prove the history was never rewritten — a producer holding
the signing key can regenerate and re-witness a whole chain, and this
first-contact check would still pass; supply --base-ref against a head
you recorded earlier to bind against that. It does
NOT prove that any declared gate passed, it does NOT prove the encodings
are a correct reading of the law, it does NOT prove this clone holds the
producer's newest release, and it does NOT prove this is the only history
the producer maintains — a stale or equivocated but honestly witnessed
clone may pass, and this verdict does NOT prove that files in any checkout
equal the verified tree.
It does NOT establish that the spec's code was trusted.
It does NOT establish that the anchor set is one the auditor trusts.
Check freshness and uniqueness by comparing head
digests out of band.

exit 0 · receipt writes a refused verdict to stderr and a passing one to stdout; this one went to stdout

First contact: nothing but this clone and the auditor's own spec.

every verdict line is receipt 0.6.1's own output over the package's own signed corpus fixture · amber marks what this clone differs in, and every refusal · passes stop at the first failure

What it provides

receipt.release_chain

Append-only hash-chained manifests over record sets: enumerated genesis, content-addressed links, immutable-prefix verification.

receipt.canonical

ECMAScript-compatible canonical JSON: one byte stream per record, so producer and verifier hash and sign identical bytes.

receipt.append_gate

Append-only enforcement for governed record trees: a candidate state must extend committed history exactly, verified against trust anchors in the consumer's own code.

receipt.tsa

RFC 3161 dual-witness time verification against trust bundles committed in the consumer's repo, with explicit unavailable-witness outcomes.

receipt.sign

Ed25519 producer signatures verified against fingerprints pinned in the consumer's own committed code; N-of-M keyrings with legacy generations — retired keys verify immutable history only.

receipt.attest

Workflow-provenance verification with self-anchoring enforcement epochs and a full-history sweep over every protected-tree commit.

receipt.corpuscomposed, not extracted

Closed-world binding of a record tree to its witnessed journal: every content file present is bound, and every bound file is present.

receipt.verifycomposed, not extracted

The spanning command behind receipt verify: history, custody, binding and declaration over the tree one commit names, stopping at the first refusal.

receipt.ratchetpending extraction

Shrink-only exception registries recomputed from live state; an excused failure that starts passing is an error until removed.

receipt.chronologypending extraction

Record-vs-event ordering tiers: does witnessed time prove the record existed before the event it predicts or observes?

The design principle

Trust anchors live in the consumer's committed code, never in runtime configuration a producer could swap. The package ships machinery; consumers pin roots. Retiring or rotating a key is a reviewed change to the consumer's repository — not a setting.

Where it comes from

The machinery arrives by extraction from three production systems that each built it independently — a signed statute corpus, pre-registered forecast records, and an observation-ledger release chain — behind a byte-equivalence gate: the extracted verifier must reproduce the source verifier's verdict, pass and fail alike, on the live production chain before any system consumes the package. What receipt verify adds on top is composition, not a fourth extraction: it spans those modules and reports their verdicts, contributing no cryptography and no trust anchors of its own. The observation ledger runs on it in production today, with differential harnesses re-proving equivalence on every package change; adoption by the Axiom corpus is underway. We built it because we needed it. We publish it because everyone shipping agent-produced records will.

Axiom's own records carry them: axiom.org/receipts