Receipt — sign an agent's work, verify it offline

receipt

Sign the work your agent did. Let anyone verify it offline.

A receipt binds an agent, a task and a file with an Ed25519 signature. Verification needs no account, no chain, no network and no permission from us. Change one character of the file or one field of the receipt, and verification fails.

This is the smallest useful thing in the agent economy: the payment rails arrived before the proof rails. x402 passed 138 million payments while most agent jobs remain unfunded and unevaluated by anyone independent.

Install

git clone https://github.com/ecstatica/ggbank-receipt
cd ggbank-receipt
python3 -m pip install --user cryptography

No dependency beyond cryptography. Python 3.10+.

Use

# 1. your agent's key (Ed25519, private key mode 0600)
python3 receipt.py keygen --out ~/.agent.key

# 2. sign a receipt over the artifact the agent delivered
python3 receipt.py issue \
  --key ~/.agent.key \
  --artifact report.pdf \
  --task q-1042 \
  --agent VOID-9 \
  --amount 25 \
  --out q-1042.receipt.json

# 3. anyone can verify it, offline
python3 receipt.py verify --receipt q-1042.receipt.json --artifact report.pdf

OK   signature valid · issuer QRs56MmYfzwtOAih…
OK   artifact matches 04002a7e5527bbad…
     deliver · VOID-9 · task q-1042 · 25.0 GG · 2026-10-25T11:56:24Z

Send the receipt with the file. The buyer runs one command and knows the file is the one that agent produced and has not changed since.

What it proves, and what it does not

Proves: this key signed this artifact hash with these fields at this time, and nothing has changed since.

Does not prove: that the work is good, or that the key belongs to a particular human. Quality is a separate judgement; identity is a separate claim.

Use it as an MCP server (what agents actually call)

mcp_server.py speaks JSON-RPC over stdio — the protocol Claude Code, Cursor, Codex, Hermes and most agent frameworks already speak. Two tools: issue_receipt, verify_receipt. No network, no dependencies beyond cryptography.

{"mcpServers": {"receipt": {"command": "python3", "args": ["/abs/path/mcp_server.py"]}}}

{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"issue_receipt",
 "arguments":{"artifact_path":"/tmp/report.pdf","agent":"VOID-9","task":"q-1042","amount_gg":25}}}
→ {"ok": true, "receipt": {...}}

Verified round trip: issue_receipt → verify_receipt returns ok: true; change the amount and it returns ok: false, reason: "signature: InvalidSignature".

What a receipt contains

{
 "spec": "ggbank.receipt/1",
 "verb": "deliver",
 "agent": "VOID-9",
 "task": "q-1042",
 "artifact": {"name": "report.pdf", "sha256": "04002a7e…", "bytes": 18422},
 "amount_gg": "25.000000",
 "fee_gg": "0.125000",
 "issued_at": "2026-10-25T11:56:24Z",
 "issuer": "<base64 public key>",
 "nonce": "…",
 "signature": "<base64>"
}

Canonical JSON (sorted keys, no whitespace) is signed, so the signed bytes are reproducible in any language. Money fields are decimal strings, never floats.

Tamper detection, tested

python3 receipt.py verify --receipt tampered.json     # FAIL signature: InvalidSignature
python3 receipt.py verify --receipt good.json --artifact edited.pdf
                                                      # FAIL artifact: hash mismatch

Licence

MIT.