Find actions with no receipt.

A receipt checker can inspect only files it receives. Compare those files with a separate action log to find what is missing.

Run four constructed actions and create three receipts. Fixture generation also writes the test harness action log. Every check below runs locally.

Limits of this evidence

Digest and local pinned-root checks are recomputed; identity, actor time, execution, and independent operation are not.

Run the walkthrough

1 · Tamper with one receipt

The record below is the run’s fs.write receipt. A log line would carry the path and a timestamp; the receipt also carries the acting principal, declared bounds, and where a challenge goes. Change the path and verify again.

action: fs.write · /workspace/report.md
principal: did:web:example#agent
bounds: scope unstated · rollback P7D
recourse: challenge window P7D · local://recourse-unset

integrity: not yet checked
authority proof: not evaluated
bounds: declared
grounding: not yet checked
recourse: declared · forum unset

STRICT-V1 · REFUSE ON INTEGRITY FAILURE · ESCALATE BELOW COUNTERPARTY-SIGNED GROUNDING

reliance · policy strict-v1not yet computed

2 · Verify the whole run

Unlocked after the first tamper.

3 · Reconcile against the harness log

Unlocked after the run verifies.

Receipt checks and coverage checks

First, check whether a supplied receipt changed. Then compare the receipt set with a separate action log. Every supplied receipt can pass while that log still contains an unmatched action. Gateways, receivers, audit systems, and test harnesses can supply the comparison record.

Limits of the action-log comparison

Bulla can find actions in the supplied action log that have no matching receipt. It cannot find actions missing from that log.

An ActionReceipt carries the transaction fields another party needs to inspect: the action, declared authority and limits, supplied evidence, and challenge path. The counterparty can keep the file after access to the provider’s system ends.

Use the same checks when a vendor operates the acting agent. Require its receipt set, retain a customer-side action record, and compare the two. Procurement language appears under buyer requirements.

Provider logs, traces, and metrics remain useful. An exported provider event can supply evidence for a receipt. The ActionReceipt gives the counterparty a standard file for one transaction, while the receiver log gives it an independent list to compare against. Bulla does not assume that either log is complete.

Run it on your agent

Find this fixture at examples/agent-fleet-blind-spot in the Bulla repository. Its wrapped path is three lines:

python

from bulla import wrap_action, event_coverage

with wrap_action("payments.charge", {"event_id": "run-7:3", "amount_minor": 12500}) as act:
    ...                                       # the consequential action

report = event_coverage(harness_log, receipts, anchor="agent-harness-log")
report["unreceipted_delta"]                   # actions that left no receipt

Continue with the Python integration guide. For an incident-shaped gateway bypass caught by the same reconciliation, see the evaluation-incident replay.

Next →QuickstartCreate and verify your first ActionReceipt.