Agent Decision Receipts — Security & Safety

Mint a tamper-evident, post-quantum-signed receipt for a consequential agent action (deploy, delete, pay, grant-access, model decision) so it can be verified later from the certificate alone. Use when an autonomous agent takes a side-effecting action that may need to be proven later, or when satisfying EU AI Act Article 12 record-keeping. Three decisions: whether an action needs a receipt, minting it, verifying it. Signing is delegated to the open-source OpenAgentOntology package. Not after-the-fact log analysis; not a hosted notary; not a legal opinion.

ra-qm claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Determines whether an action needs a receipt based on side-effecting, consequential, and later-provable criteria.
Builds and validates an action manifest with required fields (agent_id, operation, target, policy).
Mints a receipt signed with Ed25519 and, when the post-quantum backend is installed, ML-DSA-65 and SLH-DSA.
Verifies receipts from the certificate alone by recomputing the hash and checking each signature leg.
Automatically adds inputs_hash and decision_label to the manifest.
Detects missing crypto and emits an unsigned flag instead of faking a signature.

🎯 When to use it

An autonomous agent performs a side-effecting action (deploy, delete, pay, grant access) that may need to be proven later.
You need to satisfy EU AI Act Article 12 record-keeping for high-risk AI system decisions.
You want a tamper-evident, offline-verifiable record of an agent's action without relying on a database or network.
You need to support FRE 902(13)/(14)-style certification with signed evidence.

🚀 How to use

Trigger by asking to mint or verify a receipt for an agent action, or use the provided scripts. Provide the action details (agent, operation, target, policy) and optionally inputs. Example prompts:

Mint a receipt for the deploy action by agent 'my-deploy-agent' targeting 'prod/api' under policy 'EU AI Act Art 12'.
Verify this receipt.json.

Install the required package: pip install "openagentontology[pq]". Then run the build script to create an action manifest, mint the receipt, and verify it.

📄 Output: A JSON receipt file containing evidence hash and signatures, plus verification results.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/ra-qm-team/skills/agent-decision-receipts .claude/skills/agent-decision-receipts

Skill source: ra-qm-team/skills/agent-decision-receipts/SKILL.md

⚠️ Good to know

Requires the openagentontology package for minting/verifying; not a legal opinion and does not guarantee admissibility.

❓ FAQ

What does the skill do if the crypto package is not installed?

The build step still works, but minting and verifying require the openagentontology package; if missing, the primitive emits an unsigned flag instead of faking a signature.

Can a receipt be verified without contacting the issuer?

Yes, verification recomputes the hash and checks signatures from the receipt alone, with no database or network.

What fields are required in the action manifest?

agent_id, operation, target, and policy are required; inputs_hash and decision_label are added automatically.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.