iso-receipts

@agent-pattern-labs/iso-receipts

Portable evidence receipts for AI-agent work.

iso-receipts creates local, dependency-free receipt bundles that can be verified, redacted, inspected, and replayed by other tools. It is the thin artifact layer between runtime traces, Geometra browser evidence, signed proof systems, and vertical workflows such as JobForge.

A receipt archive is a ZIP file, usually named receipt.agent.zip, with:

• manifest.json - schema, hashes, command metadata, redaction status.
• events.jsonl - normalized receipt events.
• artifacts/ - stdout, generated files, screenshots, TSVs, markdown, logs.
• geometra-replay/ - optional Geometra page models or replay evidence.
• proof.json - optional external signature/proof payload.
• verdict.json - optional policy/eval result.

Everything is local-only and model-free.

Install

npm install -D @agent-pattern-labs/iso-receipts

CLI

iso-receipts capture --out receipt.agent.zip -- npm test
iso-receipts verify receipt.agent.zip
iso-receipts inspect receipt.agent.zip
iso-receipts unpack receipt.agent.zip --out receipt.agent
iso-receipts redact receipt.agent.zip --out receipt.redacted.agent.zip

capture records the wrapped command, exit code, stdout/stderr artifacts, and basic platform metadata. It does not upload anything and does not capture the process environment by default.

Directory outputs are replaced only when the destination is empty or already contains an iso-receipts manifest. Non-receipt directories are refused so unrelated files cannot be deleted accidentally.

Receipt IDs are content-derived from the complete manifest. Verification fails for changed metadata, missing or extra payloads, and directory symlinks; receipt directories therefore cannot silently import files from outside the bundle.

Library API

import { createReceipt, packReceipt, verifyReceipt } from "@agent-pattern-labs/iso-receipts";

const receipt = createReceipt({
  subject: "jobforge:application",
  events: [
    { type: "application.submitted", data: { company: "Example", status: "applied" } },
  ],
  artifacts: [
    { path: "artifacts/tracker.tsv", content: "company\tstatus\nExample\tapplied\n" },
  ],
  geometraReplay: [
    { path: "geometra-replay/page-model.json", content: "{}" },
  ],
  verdict: { ok: true },
});

packReceipt(receipt, "receipt.agent.zip");
const result = verifyReceipt("receipt.agent.zip");

Fit With The iso Stack

• iso-trace observes agent transcripts.
• iso-redact scrubs sensitive receipt payloads before sharing.
• iso-ledger records durable workflow truth.
• agent-proof can sign or challenge the receipt hash.
• geometra can provide browser page models, screenshots, and replay evidence.

The package lives in iso because receipts are a cross-runtime control artifact, not a browser automation feature or a workflow-specific output format.