Anthropic's commerce-agents reference enforces its gates in code and leaves the record to the deployment. This is that record: a signed intent and result receipt for every tool call, on the Messages API, the Agent SDK, and Managed Agents. Verifiable offline. Refusals included.
Inside a clone of the reference. Python 3.11+. Full install.
Every tool call in the reference passes through one method on all three of its runtimes; its own gates rely on that. Treeship wraps that one method: a signed intent before, a signed result after, chained from the session root.
Tool name, a SHA-256 of the canonical arguments, the role, the session tag. Never the arguments.
Validation, provenance gates, caps, fencing: the reference runs exactly as published. Not a line of it changes.
ok, blocked with the gate's name, or error. A digest of the result, the events, the timing. A held call is a signed refusal, not a gap.
The reference's safety page lists what a deployment owns: the approval surface, payment, log hygiene. Those are the three seams. One is shipped; two are next, and this page says which.
Every tool call receipted through the reference's one executor. The provenance gate holding a write becomes a signed blocked receipt naming the gate. A log that only records successes cannot tell "refused" from "never asked." A receipt can.
The merchant agent applies a change only for an id the host marked approved, a mark set just before the click and cleared just after. That is an approval with a nonce and one use, in prose. Next: the click mints a scoped, single-use Treeship approval; the apply receipt echoes the nonce; the Approval Use Journal refuses a second spend.
Checkout hands off a hosted URL the model never sees; nothing in the reference charges a card. Next: a signed digest of exactly the cart that went to checkout, chained to the order the host places. The customer gets a receipt for the cart, not a screenshot of it.
Arguments (a holder can recompute the digest; a reader learns nothing), result text (fenced third-party content), the session id (the reference's request credential, logged only as a twelve-hex tag). The receipt carries that same tag, from the reference's own helper.
Every receipt is a DSSE envelope signed with Ed25519, content-addressed, chained to its parent, and folded into a signed Merkle checkpoint when the session seals. treeship verify walks the chain offline against your own pinned roots. A published session renders at a permanent receipt URL with the same verifier running in the browser. The hub stores bytes and serves proofs; it never issues a verdict.
What a receipt proves: this key signed, at that time, that this tool was about to run with arguments of that digest, and then what the gate decided. What it does not prove: that the answer was correct. A wrong answer with a perfect receipt is still wrong. Treeship authenticates statements; it does not adjudicate commerce.
The trust boundaryAll three of the reference's runtimes take an executor_class. Pass the receipted one. Nothing else changes.