h

Author: gblinproject

README.md

@@ -41,6 +41,33 @@ It exposes four native Actions (`CHECK_GBLIN_TREASURY_HEALTH`, `INVEST_IDLE_USDC
 
 ---
 
+## AI Action Receipts — a witnessed transparency log for what your agent did
+
+The problem this attacks is the #1 barrier to AI adoption in 2026: **nobody can
+prove, after the fact, exactly what an AI did** (surveys: workers burn 2–4 h/week
+verifying AI output; 70% of orgs say they cannot govern their agents). Our answer
+is the smallest honest primitive: a public, append-only **RFC 6962 transparency
+log** for AI actions. You send **hashes only** (never content); you get back a
+portable receipt any third party can verify offline, forever.
+
+```
+receipt = canonical payload
+        + Ed25519 signature            (key: gblin.digital/receipts-log)
+        + RFC 6962 inclusion proof     (leaf → Merkle root)
+        + C2SP signed checkpoint       (origin, tree size, root)
+```
+
+- Seal (paid, unlimited): `POST https://gblin.digital/api/x402/seal` — $0.01 USDC via x402.
+- Seal (demo, 5/day/IP): `POST <worker>/v1/seal-demo` or MCP tool `seal_action_demo`.
+- Read free forever: `<worker>/v1/receipt/:index` · `/log` · `/log/checkpoint` · `/log/proof/:index` · human page `/receipt/:index`.
+- Daily EAS anchor on Base of the tree root (verifiable on base.easscan.org, schema `0x9f433a96…`, promiseId `keccak256("gblin-receipts-log")`).
+- **Offline verifier, zero dependencies:** [`verify-receipt.mjs`](./verify-receipt.mjs) — `node verify-receipt.mjs receipt.json`.
+
+A seal proves **existence and time**, independently witnessed (the same C2SP
+witness network that cosigns transparency logs — we already witness-exchange
+with a third-party log operator). It is **not** a compliance certificate and
+**not** an endorsement of the content. Worker: `<worker>` = `https://gblin-mcp.gblin-mcp-worker.workers.dev`.
+
 ## Coherence Proof — verify GBLIN keeps its promises
 
 GBLIN pre-registers hash-pinned public promises, then runs an automaton that probes them every 10 minutes and seals each closed day as an [EAS attestation](https://base.easscan.org/schema/view/0x9f433a96467ab75530009970e5aa938ec94d8a49f08f66e7381822d557b448ef) on Base. Reading is free forever; the paid service is being observed — the certifier submits itself to its own instrument first.

verify-receipt.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+// verify-receipt.mjs — offline verifier for GBLIN AI Action Receipts.
+// Zero dependencies (Node 18+). You do NOT need to trust gblin.digital:
+// this script re-derives everything from the receipt JSON itself.
+//
+//   node verify-receipt.mjs receipt.json
+//   curl -s https://gblin-mcp.gblin-mcp-worker.workers.dev/v1/receipt/0 | node verify-receipt.mjs /dev/stdin
+//
+// Checks: (1) canonical payload → leaf hash (RFC 6962, 0x00 prefix);
+// (2) Ed25519 receipt signature over "gblin-receipt/v1\n"+canonical;
+// (3) inclusion proof leaf→root (0x01 prefix);
+// (4) checkpoint note signature (C2SP) over origin/size/root by the SAME key;
+// (5) key hash inside the verifier_key matches name+alg+pubkey.
+// The daily EAS anchor on Base can be checked independently on base.easscan.org
+// (schema 0x9f433a96..., promiseId keccak256("gblin-receipts-log")).
+
+import { readFileSync } from "fs";
+import { webcrypto as crypto } from "crypto";
+
+const die = (m) => { console.error("FAIL:", m); process.exit(1); };
+const ok = (m) => console.log("  ✓", m);
+const b64 = (u8) => Buffer.from(u8).toString("base64");
+const unb64 = (s) => new Uint8Array(Buffer.from(s, "base64"));
+const te = new TextEncoder();
+const cat = (...p) => { const n=p.reduce((a,x)=>a+x.length,0); const o=new Uint8Array(n); let i=0; for(const x of p){o.set(x,i);i+=x.length;} return o; };
+const sha256 = async (u8) => new Uint8Array(await crypto.subtle.digest("SHA-256", u8));
+
+function canonicalize(v) {
+  if (v === null || typeof v !== "object") return JSON.stringify(v);
+  if (Array.isArray(v)) return "[" + v.map(canonicalize).join(",") + "]";
+  return "{" + Object.keys(v).sort().map((k) => JSON.stringify(k) + ":" + canonicalize(v[k])).join(",") + "}";
+}
+
+const file = process.argv[2] || die("usage: node verify-receipt.mjs receipt.json");
+const r = JSON.parse(readFileSync(file, "utf8"));
+const receipt = r.receipt || r; // accept either the bare receipt or an API wrapper
+if (receipt.format !== "gblin-receipt/v1") die("unknown format: " + receipt.format);
+
+// (5) verifier key structure
+const m = /^([^+]+)\+([0-9a-f]{8})\+([A-Za-z0-9+/=]+)$/.exec(receipt.verifier_key) || die("bad verifier_key");
+const keyRaw = unb64(m[3]);
+if (keyRaw[0] !== 0x01) die("verifier_key alg is not Ed25519 note key (0x01)");
+const pub = keyRaw.slice(1);
+const kh = (await sha256(cat(te.encode(m[1] + "\n"), keyRaw))).slice(0, 4);
+if (Buffer.from(kh).toString("hex") !== m[2]) die("verifier_key hash mismatch");
+ok(`verifier key: ${m[1]} (${m[2]})`);
+
+// (1) canonical → leaf
+const canonical = canonicalize(receipt.payload);
+const leaf = await sha256(cat(Uint8Array.of(0x00), te.encode(canonical)));
+if (b64(leaf) !== receipt.leaf) die("leaf hash does not match canonical payload");
+ok("leaf = SHA256(0x00 || canonical(payload))");
+
+// (2) receipt signature (present on freshly-sealed receipts; /v1/receipt omits it)
+const key = await crypto.subtle.importKey("raw", pub, { name: "Ed25519" }, false, ["verify"]);
+if (receipt.signature) {
+  const good = await crypto.subtle.verify({ name: "Ed25519" }, key, unb64(receipt.signature), te.encode("gblin-receipt/v1\n" + canonical));
+  if (!good) die("receipt signature invalid");
+  ok("receipt Ed25519 signature valid");
+}
+
+// (3) inclusion proof
+let h = leaf, idx = receipt.index, size = receipt.tree_size;
+let lo = 0, hi = size;
+for (const pB64 of receipt.inclusion_proof) {
+  const sib = unb64(pB64);
+  let k = 1; while (k * 2 < hi - lo) k *= 2;
+  if (idx < lo + k) { h = await sha256(cat(Uint8Array.of(0x01), h, sib)); hi = lo + k; }
+  else { h = await sha256(cat(Uint8Array.of(0x01), sib, h)); lo = lo + k; }
+}
+// NB: path is leaf→root; recompute bounds properly (redo forward):
+{
+  const proof = receipt.inclusion_proof.map(unb64);
+  const rec = async (i, a, b, d) => {
+    if (b - a === 1) return leaf;
+    let k = 1; while (k * 2 < b - a) k *= 2;
+    if (i < a + k) { const L = await rec(i, a, a + k, d); return sha256(cat(Uint8Array.of(0x01), L, proof[d.n++] ?? die("proof too short"))); }
+    const R = await rec(i, a + k, b, d);
+    return sha256(cat(Uint8Array.of(0x01), proof[d.n++] ?? die("proof too short"), R));
+  };
+  // proof array is ordered leaf-upward; rebuild with an index counter walking the same recursion order
+  const d = { n: 0 };
+  const order = [];
+  const collect = (i, a, b) => { if (b - a === 1) return; let k=1; while (k*2 < b-a) k*=2; if (i < a+k) { collect(i,a,a+k); order.push(["R",a+k,b]); } else { collect(i,a+k,b); order.push(["L",a,a+k]); } };
+  collect(receipt.index, 0, size);
+  if (order.length !== proof.length) die(`proof length ${proof.length} != expected ${order.length}`);
+  let cur = leaf;
+  for (let j = 0; j < order.length; j++) {
+    cur = order[j][0] === "R" ? await sha256(cat(Uint8Array.of(0x01), cur, proof[j])) : await sha256(cat(Uint8Array.of(0x01), proof[j], cur));
+  }
+  if (b64(cur) !== receipt.root) die("inclusion proof does not reach the stated root");
+}
+ok(`inclusion proof: leaf #${receipt.index} → root of tree size ${size}`);
+
+// (4) checkpoint note
+const note = receipt.checkpoint || die("no checkpoint in receipt");
+const sep = note.indexOf("\n\n");
+const body = note.slice(0, sep + 1);
+const lines = body.split("\n");
+if (lines[0] !== m[1]) die("checkpoint origin mismatch");
+if (Number(lines[1]) !== size) die("checkpoint size != receipt tree_size");
+if (lines[2] !== receipt.root) die("checkpoint root != receipt root");
+const sigLine = note.slice(sep + 2).split("\n").find((l) => l.startsWith("— " + m[1] + " ")) || die("no signature line for origin");
+const payloadSig = unb64(sigLine.split(" ")[2]);
+if (payloadSig.length !== 68) die("bad checkpoint sig payload");
+if (Buffer.from(payloadSig.slice(0, 4)).toString("hex") !== m[2]) die("checkpoint keyhash mismatch");
+const goodCp = await crypto.subtle.verify({ name: "Ed25519" }, key, payloadSig.slice(4), te.encode(body));
+if (!goodCp) die("checkpoint signature invalid");
+ok("checkpoint (C2SP signed note) valid and consistent with receipt");
+
+console.log(`\nPASS — receipt #${receipt.index} verified offline.`);
+console.log(`Action: ${receipt.payload.action}${receipt.payload.demo ? " (DEMO)" : ""} · ${receipt.payload.ts}`);
+console.log("Reminder: a seal proves existence and time. It does not certify the content.");