What problem does it solve?
Autonomous agents take side-effecting actions like deploys, deletions, and payments, but ordinary logs can be silently edited and cannot prove what happened later. This Skill mints a tamper-evident, cryptographically signed receipt at the moment of action so auditors, insurers, or regulators can verify it offline from the certificate alone.
Core Features & Use Cases
- Decision framework: A three-question test (side-effecting, consequential, later-provable) decides whether an action warrants a receipt, with high-signal triggers like deploy, delete, pay, and grant_access.
- Manifest building and validation: A stdlib-only Python script builds an ASCII-safe action manifest with required fields (agent_id, operation, target, policy) and hashes inputs so secrets and PII are never stored in cleartext.
- Post-quantum signing and verification: Signing is delegated to the open-source OpenAgentOntology primitive, which signs with Ed25519 plus ML-DSA-65 (FIPS 204) and SLH-DSA (FIPS 205) legs, and verification recomputes the evidence hash and checks each signature leg with no database or network.
- Use Case: A deployment agent approves a production release under EU AI Act Article 12 record-keeping obligations; the receipt minted at execution can later be verified by a regulator years afterward, even if a quantum computer could forge Ed25519.
Quick Start
Ask the agent to build an action manifest for a deploy operation against prod/api under the EU AI Act Art 12 policy, then mint and verify the signed receipt using the openagentontology package.
