Actions with Receipts: Jointly Binding Claims, Evidence, and Execution for Replayable Tool-Agent Auditing

1 INTRODUCTION

• The receipt contract makes provenance a deterministic, persistable, replayable object while keeping oracle labels separate from the online policy.Its stated security boundary trusts the runner and observation logger during execution.Source: §1 · p. 1
• The audit gap is that a source-linked claim may not be tied to the execution that emitted it, while an execution log may not identify the answer substring its evidence supports.Keeping the records separate leaves room for transplantation across answers, actions, runs, and source versions.Source: §1 · p. 1
• The paper introduces claim-anchored joint receipts, seven independently testable properties, and an integrity plane separate from pluggable support evaluators.Its evaluations cover substitution resistance, property necessity, baselines, audit non-interference, semantic support, model-backed tool use, and dynamic source state.Source: §1 · p. 2

2 RELATED WORK

• Tool-use benchmarks emphasize task completion, interaction quality, or attack resistance, while faithfulness audits find generated rationales can diverge from the actions that produced them (Deng et al., 2023).EC-Agent complements these lines by making evidence references and event order independently inspectable.Source: §2 · p. 2
• Attribution and factual-support methods provide task-level or semantic signals, whereas a syntactically valid receipt can still attach a semantically insufficient span (Gao et al., 2023; Min et al., 2023; Yan et al., 2025; Wei et al., 2026; Niu et al., 2024; Saad-Falcon et al., 2024; Es et al., 2024).The paper presents deterministic receipt verification as complementary to those evaluations.Source: §2 · p. 2
• Provenance and supply-chain systems offer integrity primitives, while EC-Agent applies related ideas at claim-to-span granularity for tool traces and pairs them with oracle-separated replay (Buneman et al., 2001; Cheney et al., 2009; World Wide Web Consortium, 2013; Merkle, 1988; Laurie et al., 2021; Torres-Arias et al., 2019; Coalition for Content Provenance and Authenticity, 2024).Table 1 compares documented system emphases and the replay interface studied here.Source: §2 · p. 2, Table 1 · p. 2
• Fine-grained claim provenance and execution provenance are complementary, but neither specifies a cryptographic association between an exact emitted claim and its producing execution prefix.The contribution is an executable association among claim, evidence, execution, and source state, tested through replay and substitution.Source: §2 · pp. 2–3
• The minimal auditable unit is the tuple of emitted claim, source span, source version, and ordered execution prefix, evaluated through seven properties.These include claim-emission, source, ordered-execution, oracle, persisted-object replay, rerun-consistency, and version/access-state binding.Source: §2 · p. 3

3.1 PROBLEM AND CONTRACT

• Each claim’s auditable unit links its emission anchor, ordered evidence references, execution commitment, manifest identity, and source version and access state.The contract treats this as a joint tuple rather than an isolated citation or trace.Source: §3.1 · p. 3

3.2 CLAIM-EMISSION BINDING

• Emission anchors locate a claim in a committed event field by event index and half-open string offsets; verification reconstructs the substring and checks its equality and hash.Multiple final-answer claims are extracted deterministically into claim IDs and anchors before receipt emission.Source: §3.2 · p. 3

3.3 JOINT EXECUTION AND RECEIPT COMMITMENT

• Integrity checks claim, source, trace, joint commitment, and source state, while a separate configured evaluator scores support; integrity validity does not imply support.The two outputs remain distinct through the post-freeze audit.Source: §3.3 · p. 4, Figure 1 · p. 5
• The runner commits the ordered event prefix after the answer, persists receipts and traces, then checks bundles by replay and fresh deterministic reruns before oracle labels are joined.The execution digest excludes receipt fields, verifier results, and the outer bundle digest from the committed prefix.Source: §3.3 · p. 4
• The guarantees are evaluated within the trusted runner-and-observation-logger view; authenticated observation anchors remain a separate extension for deployments requiring them.Source: §3.3 · p. 5

4.2 JOINT-BINDING RESULTS

• 1,275 of 1,280 cross-object attacks (0.9961) are detected; removing a targeted property drops its targeted-attack detection to 0.0156–0.0625.Audit-only instrumentation preserves exact event traces at 0.9986 and final answers at 0.9992, with task-success difference 0.0000.Source: §4.2 · p. 5, Figure 2 · p. 6

4.3 PROTOCOL SANITY CHECK; 4.4 MATCHED COST ACCOUNTING

• The fixed-corpus protocol verifies persisted bundle replay and a separate deterministic execution rerun, while its title-derived candidate tests contract execution rather than semantic generalization.The matched one-retrieval control adds 3.0 declared tokens and one verifier call, with the lexical proxy unchanged at 0.0781.Source: §4.3 · p. 6, §4.4 · p. 6, Table 2 · p. 6

4.5 MUTATION AUDIT: THE CENTRAL FAILURE BOUNDARY

• 144/144 structural mutations are rejected, while 16/16 lexical-adversarial controls are accepted by design, exposing the boundary between receipt integrity and semantic support.The mutation audit applies ten mutations to each of 16 valid final-only certificates.Source: §4.5 · p. 7, Figure 3 · p. 7

4.6 CURATED SEMANTIC-SUPPORT CALIBRATION

• On 20 curated non-title cases, the guarded rule reports precision 1.0000 and recall 0.8889, versus lexical precision 0.5000 and recall 0.8889.The paired rules use identical claim–span pairs and curated support labels.Source: §4.6 · p. 7, Table 4 · p. 7

4.7 HELD-OUT EVALUATION

• On 384 adjudicated claim–span pairs, the conflict-aware guard reaches F1 0.8865 and false acceptance 0.0729, versus lexical overlap at 0.8019 and 0.3229.Annotator agreement is κ = 0.834, with interval [0.789, 0.879].Source: §4.7 · p. 8, Figure 4 · p. 8
• Evidence-aware stopping has the highest task success (0.7312) and lowest latency (15.68 s), while adding the conflict-aware guard yields the highest semantic F1 (0.8721) and lowest false acceptance (0.0617).On unseen failure families, the guard ranks highest in precision and F1 and lowest in false acceptance, but covers 0.4479 of required claims versus 0.5781 for lexical overlap.Source: §4.7 · pp. 8–9, Table 6 · p. 8, Table 7 · p. 9

4.8 OPERATING POINTS AND INTERPRETATION; 4.9 MECHANISM-LEVEL ERROR ANALYSIS

• The experiments separate protocol validity, receipt cost, semantic support, utility, and dynamic-source outcomes; held-out rows are keyed by task, policy, seed, corpus version, and claim identifier.Text, identity, order, presence, and oracle-field mutations reach distinct verifier checks, while semantic adequacy remains evaluator-dependent.Source: §4.8 · p. 9, §4.9 · p. 9

4.10 LIMITATIONS

• The integrity guarantee assumes a trusted runner and observation logger; open-ended semantic shifts and compromised recorders require additional evidence.The fixed-corpus screen uses title-derived claims, and semantic results depend on the adjudication rubric and frozen support evaluators.Source: §4.10 · p. 9

• 1,275 of 1,280 substitutions are detected by the joint contract across claims, evidence, actions, runs, and source states.Source: §5 · p. 9
• The conflict-aware guard reaches semantic F1 0.8865 with false acceptance 0.0729.Source: §5 · p. 9
• The matched guard reaches task success 0.7278 with joint replay validity 0.9976, while dynamic evaluation reaches injection resistance 0.9078 with perturbed-task success 0.8127.Source: §5 · p. 9

• Generative AI tools were used to polish wording and summarize references.Source: AI USE STATEMENT · p. 10
• The authors report that generative AI was not used to generate experimental results, synthetic datasets, mathematical claims, proofs, or decisions about research conclusions.Source: AI USE STATEMENT · p. 10
• The authors state that they designed and verified the methodology, experimental setup, analysis, and interpretation of results, and take responsibility for the final content.Source: AI USE STATEMENT · p. 10

• The evaluation covers research benchmark data, tool traces, and de-identified claim–span annotations under controlled conditions.Source: ETHICS STATEMENT · p. 10
• Receipt logs may retain sensitive source content or linkable identifiers, so deployments require access control, data minimization, and appropriate retention limits.Source: ETHICS STATEMENT · p. 10
• The Supplementary Material excludes credentials, private endpoints, and annotator identities and respects source-data redistribution terms.Source: ETHICS STATEMENT · p. 10

• The Supplementary Material provides code, the verifier, canonical serialization contract, an oracle-free replay fixture, and expected digest vectors.Source: REPRODUCIBILITY STATEMENT · p. 10
• Appendices A–E describe algorithms, split rules, baseline configurations, seeds, metric definitions, and artifact coverage.Source: REPRODUCIBILITY STATEMENT · p. 10
• The replay fixture supports an independent implementation check, while reproducing an aggregate requires row-level evidence and its frozen corpus or task manifest.Source: REPRODUCIBILITY STATEMENT · p. 10

A.1 NOTATION AND TASK DEFINITION

• Claims are evaluated against an execution instance containing a request, fixed documents and spans, retrieval order, and action budget; semantic labels remain outside online policy state.Integrity, support, and bundle replay are separate tasks, and evaluator labels are joined only after verification and replay.Source: §A.1 · p. 13

A.2 RECEIPT SCHEMA AND CANONICAL SERIALIZATION

• Each receipt combines an emission anchor, ordered source references, execution and joint digests, while manifests identify the corpus snapshot and access state.References carry document and span identifiers, half-open offsets, hashes, and exact quotes; canonical serialization and ordered events make commitments deterministic.Source: §A.2 · pp. 13–14

A.3 FULL ALGORITHM AND LIFECYCLE

• The lifecycle commits the event prefix through the answer, emits and verifies receipts, persists an oracle-free bundle, replays it, reruns execution, then joins labels.Bundle replay rechecks saved inputs without invoking the policy; execution rerun is a separate fresh policy execution.Source: §A.3 · p. 14, Table 8 · p. 14

A.4 VERIFIER PREDICATE AND EDGE CASES

• Support is a deterministic lexical test using a normalized substring or token overlap; invalid offsets, quote or hash mismatches, and malformed trace fields fail verification.The fixed-corpus audit assumes the source snapshot remains available, while a separate dynamic-document test varies versions and access states.Source: §A.4 · p. 15

A.5 THREAT MODEL, GUARANTEES, AND NON-GOALS

• The contract provides record, source-content, and execution-order integrity under trusted runner, logger, manifest, verifier, and replay components; observation authenticity needs an external anchor.A lexical-adversarial mutation can pass the support predicate, showing that cryptographic integrity and semantic adequacy are independent.Source: §A.5 · p. 15

A.6 OBJECTIVE AND COST ACCOUNTING

• The matched cost vector counts tool calls, declared tokens, and verifier calls; the reported fixture adds 3.0 tokens and one verifier call to the one-call route.These protocol counters omit serving latency, monetary price, network retries, and asynchronous queue delay.Source: §A.6 · p. 16

B.1 FIXED-CORPUS CONSTRUCTION AND DATA PROVENANCE

• The fixed-corpus screen uses 128 local HotpotQA dev-distractor records, constructs one required claim from the top-ranked title, and reports a 0.0781 oracle-only title proxy.A separate 64-record train-corpus adapter reports 0.0625; the sets are not pooled.Source: §B.1 · p. 16, Table 9 · p. 16

B.2 POLICY VARIANTS AND INFORMATION BOUNDARY

• Four matched variants range from no receipt to final-only, action-level, and evidence-aware policies, with oracle labels and benchmark outcomes kept evaluator-only.Evidence-aware uses the first retrieved span passing the shared lexical predicate as its stopping and support signal.Source: §B.2 · p. 16

B.3 SPLIT CONSTRUCTION AND LOCKED-TEST CONTROLS

• Test identities are disjoint across source rows, claims, tasks, and dynamic-document conditions, and the split manifest is frozen before test execution.Identity intersections invalidate test metrics until the split is repaired.Source: §B.3 · p. 17

B.4 METRIC DEFINITIONS AND UNCERTAINTY

• Binary metrics expose their denominators, while paired studies report seed variation and task-level bootstrap intervals without treating seeds as independent task examples.Unsupported-claim false acceptance is FP/(FP + TN); undefined denominators are reported as N/A.Source: §B.4 · p. 17

B.5 INDEPENDENT SEMANTIC ANNOTATION PROTOCOL

• The semantic study uses blinded independent labels for non-title claim–span pairs, mapping only supported pairs to the positive binary class.Pairs unresolved from the cited span alone count as unsupported for the receipt-support metric and receive an ambiguity tag.Source: §B.5 · pp. 17–18

B.6 MATCHED MODEL-BACKED AGENT PROTOCOL

• The model-backed study pairs five policies on hidden task IDs under a frozen model, prompt, tool schema, and budget, measuring task success, semantic support, validity, cost, and latency.Timeouts and invalid outputs remain failures in the policy denominator.Source: §B.6 · p. 18

B.7 DYNAMIC DOCUMENT AND ACCESS-CONTROL PROTOCOL

• The dynamic study tests versioned documents, revoked access, unauthorized spans, reordered versions, and prompt or tool-output injection, recording version hashes and access decisions.It distinguishes valid refusal under revoked access from over-rejection on authorized tasks.Source: §B.7 · p. 18

C.1 EXECUTABLE PROPERTY MAP

• The contract names seven independently evaluated properties; claim anchors, oracle separation, replay, rerun, and version/access fields complement source-span metadata and ordered logs.Semantic support and task utility are reported separately rather than inferred from the properties alone.Source: §C.1 · p. 19, Table 10 · p. 19

C.2 VERIFIER IMPLEMENTATION CONTRACT

• The verifier returns a Boolean validity decision and reason codes for schema, source, offsets, hashes, quotes, event digests, action types, and lexical support.Bundle replay reconstructs commitments from persisted inputs and treats a mismatch in the stored integrity result as a replay mismatch.Source: §C.2 · pp. 19–20

C.3 BASELINE AND CONTROL CONTRACTS

• Matched baselines share retrieval order, stopping condition, and answer candidate, while receipt policies differ in when they emit certificates and the guard they apply.The conflict-aware guard adds numeric, entity, and contradiction checks before a lexical pass.Source: §C.3 · p. 20

C.4 CONFLICT-AWARE SUPPORT CONTRACT

• The conflict-aware support guard combines lexical overlap with numeric, entity, and temporal inclusion checks and rejects configured polarity conflicts; it does not alter integrity decisions.Its fixed configuration is a calibration/mechanism screen, not a substitute for the independently adjudicated split.Source: §C.4 · pp. 20–21

C.5 CONFIGURATION, RANDOM SEEDS, AND RUN IDENTITY

• Run manifests record policy, corpus, configuration, runtime, and output identities; paired comparisons use seeds 13, 17, and 23 and reject mismatched conditions.Each seed has an independent run directory, and task identity stays stable across policies within a seed.Source: §C.5 · p. 21

C.6 RUNTIME AND RESOURCE ACCOUNTING

• Runtime reporting separates protocol counters from model-serving costs, and the matched early-stop modes share one retrieval route while the 9.94-call result is a separate stopping-policy diagnostic.The model-backed study additionally accounts for tokens, retries, wall-clock latency, and component latencies.Source: Figure 5 · p. 21, §C.6 · pp. 21–22

C.7 REPRODUCTION COMMANDS AND OUTPUTS

• The replay command verifies a checked-in fixture and exits nonzero on mismatch; reconstructing headline rows requires the corresponding raw bundle, adapter, and locked manifest.Output rows include trace, receipt, replay, rerun, and budget fields, while post-hoc labels remain separate.Source: §C.7 · p. 22

D.1 COMPLETE FIXED-CORPUS RESULTS

• Certificate-producing rows passed implemented checks on the separate 64-row train split, whose title-match proxy remained separate from the dev screen.The split was not pooled with dev because the row sets have distinct split identities and corpus manifests.Source: §D.1 · p. 22, Table 13 · p. 22

D.2 MUTATION TAXONOMY AND PROTOCOL FAILURES

• All 144 structural mutations were rejected, while all 16 lexical-adversarial controls passed, showing that structural receipt validity does not ensure semantic support.The mutation audit applied ten changes to each of 16 valid final-only certificates.Source: §D.2 · p. 23, Table 15 · p. 23

D.3 CLAIM-EMISSION AND TRANSPLANT AUDIT

• 1,275 of 1,280 cross-object mutations (0.9961) were detected by the joint contract, with a 0.0031 false-rejection rate.The audit included claim, evidence, trace, and source-version transplants; all evidence, cross-document, and cross-version transplants were detected.Source: §D.3 · p. 23, Table 16 · p. 24

D.4 PROPERTY-NECESSITY ABLATION

• Removing a targeted property reduced its attack-detection rate to 0.0156–0.0625, while unrelated checks retained their full-contract rates.Each ablation removed one property and reran its intended attack family with other checks fixed.Source: §D.4 · p. 23, Table 17 · p. 24

D.5 CITATION AND EXECUTION-LOG BASELINES

• Citation plus trace and a shared run ID detected 0.9453 of cross-run swaps but only 0.2266 of claim transplants.The comparison identifies claim anchoring as the missing association in that baseline.Source: §D.5 · p. 24

D.6 INDEPENDENT HUMAN ADJUDICATION OF CLAIM-TO-SPAN SUPPORT

• The guard raised precision by 0.1885 points and F1 by 0.0846 points while reducing false acceptance by 0.2500 points versus the lexical baseline.The locked non-title split contained 384 adjudicated claim–span pairs; certificate validity alone had high recall but low precision.Source: §D.6 · p. 25, Table 19 · p. 25

D.7 SEMANTIC-SUPPORT BASELINES / D.8 CONFLICT-GUARD COMPONENT ABLATION

• Semantic baselines remain offline support functions, while the component ablation holds claim–span pairs and labels fixed to isolate typed checks.The ablation reports category-level false acceptance across numeric, entity, temporal, contradiction, paraphrase, multi-hop, and insufficient-evidence cases.Source: §D.7 · p. 25, §D.8 · p. 26

D.9 UNSEEN SEMANTIC FAILURE FAMILIES

• On unseen failure families, the guard reached F1 0.8679 and false acceptance 0.0938, versus 0.7783 and 0.3490 for lexical overlap.The held-out families exclude normalized surface patterns and contradiction relations found in calibration.Source: §D.9 · p. 26

D.10 MATCHED MODEL-BACKED TOOL-USE EVALUATION

• The guard had the highest semantic F1 and lowest false acceptance among five policies, while evidence-aware achieved task success 0.7312 at 5.34 calls and 15.68 seconds.The guard retained joint replay validity of 0.9976; evidence-aware had the lowest call and latency cost.Source: §D.10 · pp. 26–27, Figure 6 · p. 27

D.11 PER-SEED AND REPLAY-FAILURE ACCOUNTING / D.13 DYNAMIC DENOMINATORS AND UNCERTAINTY

• Bundle replay reloads persisted objects without policy execution, whereas execution rerun launches the frozen policy and compares trace commitments; dynamic ledgers keep attack and paired-clean denominators distinct.Separate failure categories prevent persisted-object mismatches from being attributed to policy nondeterminism or over-rejection of authorized sources.Source: §D.11 · pp. 27–28, Table 23 · p. 28, §D.13 · p. 29

D.12 DYNAMIC-DOCUMENT, INJECTION, AND DOWNSTREAM ROBUSTNESS

• The guard achieved the highest stale rejection, unauthorized-span rejection, injection resistance, conflict resolution, and perturbed-task success among certificate policies; clean-task success stayed within a narrow band.The evaluation stratified outcomes by attack family and document version.Source: §D.12 · p. 28, Table 24 · p. 28, Figure 7 · p. 29

D.14 FACTORIAL ABLATION OF AUDIT AND DECISION MECHANISMS

• The factorial design varies receipt instrumentation, evidence-aware stopping, and conflict-aware guarding across matched task–seed tuples, attributing changes to the factor that differs.The joint endpoint requires both bundle replay and execution rerun to pass.Source: §D.14 · p. 29, R S G Success Sem. F1 False acc. Calls… · p. 30, Table 26 · p. 30

D.15 AUDIT-ONLY BEHAVIORAL NON-INTERFERENCE

• Audit-only instrumentation produced an exact trace-match rate of 0.9986 and task-success difference of 0.0000 on matched executions.Exact matching includes canonicalized event order and textual fields; the design’s stopping and guarding factors intentionally change decision behavior.Source: §D.14 · p. 29, §D.15 · p. 30, Table 27 · p. 30

D.16 RECEIPT, VERIFICATION, AND REPLAY OVERHEAD

• Each receipt occupied 1,876 bytes beside an 11,243-byte trace, for 16.9% storage overhead; online serialization and verification took 0.19 and 0.47 ms.Bundle replay took 1.31 ms and execution rerun 16.88 s.Source: §D.16 · p. 31, Table 28 · p. 31

D.17 SENSITIVITY AND ADDITIONAL ANALYSES / D.18 RESULT CONSISTENCY AND METRIC RECONCILIATION

• Raising the lexical threshold from 0.25 to 1.00 increased precision from 0.6606 to 0.9180 and decreased recall from 0.9531 to 0.5833.At the primary 0.50 operating point, F1 was 0.8019 and coverage was 0.6042; reported studies retain distinct manifests and denominators.Source: Table 29 · p. 31, §D.17 · p. 31, §D.18 · pp. 31–32

E.1 ARTIFACT INVENTORY AND EVIDENCE LEVELS / E.2 MANIFEST FIELDS AND INTEGRITY CHECKS / E.3 ANONYMOUS RELEASE AND DATA HANDLING / E.4 REPRODUCTION CHECKLIST AND TABLE GENERATION

• The artifact package distinguishes run provenance, unit-level replay, raw per-case evidence for aggregate recomputation, and the corpus adapter and input version needed for full headline reconstruction.The reproduction sequence validates hashes and fixtures, replays receipts, joins labels after checks, and generates metrics from validated raw rows.Source: §E.1 · p. 32, §E.4 · pp. 33–34

E.5 SCOPE AND LIMITATIONS

• The primary deployment boundary is the trusted runner and observation logger; authenticity against an untrusted recorder requires a signed observation-time log and bound access state and document version.Semantic support requires an independent entailment or human-label signal in addition to deterministic source-integrity checks.Source: §E.5 · p. 34

E.6 ETHICAL AND BROADER-IMPACT CONSIDERATIONS

• The fixed-corpus evaluation uses research benchmark data rather than user interaction data, and raw traces should be access-controlled with retention windows for sensitive content.Hashes may remain linkable identifiers, and document content is distributed only when its source license permits redistribution.Source: §E.6 · p. 34

E.7 OPERATIONAL AUDIT CHECKLIST

• The operational checklist persists oracle-free receipts and traces, reloads and rechecks them in a fresh process, then compares deterministic reruns before joining semantic labels.Failed invariants stop table generation rather than carrying aggregates across splits.Source: §E.7 · pp. 34–35

E.8 EVIDENCE LEDGER

• The evidence ledger maps experiments to manifests, split identities, seeds, schemas, and retained artifacts so reported measurements remain tied to their run identities.The fixed-corpus, mutation, and calibration measurements use distinct manifests and denominators.Source: §E.8 · p. 35, Table 31 · p. 35