AgentReceipt

AgentReceipt is a local evidence sidecar that records AI-assisted coding sessions and exposes signed, machine-readable replay and review artifacts.

AI-assisted software work is hard to review when git state, filesystem changes, instruction context, provider logs, commands, quality checks, and final patch evidence are scattered across local tools.

I designed and implemented the Go CLI, evidence model, git and filesystem capture, Ed25519 signing, replay/focus JSON contracts, installer, and reviewer-facing outputs. The broader project provides the complete sidecar workflow; my work spans its command surface and internal evidence pipeline.

• A Cobra-based Go CLI coordinates explicit start/stop sessions, a git monitor, a filesystem watcher, and best-effort Codex JSONL or Claude hook ingestion.
• Observed events are hash-chained and finalized into local receipts, signatures, patch artifacts, replay reports, and compact focus queues for coding-agent loops.
• The machine-facing commands are sessions, focus, replay, schema, and verify diff; human review and export commands remain separate renderers over the same captured evidence.

agentreceipt start --watch
# run the AI-assisted coding session
agentreceipt stop
agentreceipt focus --session <id>
agentreceipt verify diff --session <id> --against merge-base --json

• The CLI runs as a sidecar instead of launching or proxying the coding agent, so teams can keep their existing terminal workflow.
• Git and filesystem observations are high-confidence sources; provider logs enrich the receipt but never block finalization when their format changes or data is missing.
• Raw prompts, raw tool output, and provider logs stay out of exports by default, while JSON Schema defines stable contracts for machine consumers.

• Matching a live Codex session log to the current repository without depending on an official provider API required best-effort parsing and explicit confidence degradation.
• Patch verification has to distinguish captured session activity from later workspace changes while preserving enough evidence to explain mismatches.
• Replay and focus outputs have to remain deterministic and compact enough for automation while still pointing back to the underlying event evidence.

• Codex live watching is the primary provider path; Claude support is currently hook-based and does not provide equivalent transcript coverage.
• Risk classification is heuristic, and AgentReceipt observes rather than sandboxing, approving, denying, or enforcing team policy.
• Keeping evidence local protects prompt data but leaves hosted policy distribution, GitHub App enforcement, and organization-wide controls outside the current release.

The public repository's latest tagged release is v0.10.1, published June 21, 2026, with Linux and macOS release artifacts. The current workflow is local-only and Codex-first.

• GitHub repository
• README
• v0.10.1 release

• Replay and focus contract specifications
• GitHub pull-request workflow design

August 9, 2026