OpenChainGraph · CRY-05 · Session Receipt · Zero-Egress

Agent-Action Audit-Trail Aggregator

Collapse a whole agent session into one tamper-evident regulatory receipt. Paste the OpenChainGraph artifacts (or bare execution_hash strings) collected across the session; the aggregator builds a SHA-256 Merkle tree over the ordered leaf hashes, returns the Merkle root, a per-leaf inclusion proof, and an ordered chain-depth map. The single audit object suited to EU AI Act Art. 12 record-keeping and DORA. Exports an AP2 cryptographic_mandate with session_receipt_root set. Client-side · Zero PII.

v1.0.0 cryptographic_mandate SHA-256 Merkle session_receipt_root EU AI Act Art.12 DORA Zero PII

↑ ART-30 Conformance ↑ ART-31 A2A·x402 ↑ ART-33 MCP Attestation ↓ CRY-04 Merkle Verify ↓ PTG-01 Prompt Template

🔒 All inputs are processed locally in your browser. No data is transmitted. Paste only OpenChainGraph artifacts or execution_hash strings — these carry no PII by design. Use synthetic or anonymised inputs only.

Session Artifacts — paste N OpenChainGraph artifacts (or hashes)

JSON array of artifacts or execution_hash strings Each element is either a full OpenChainGraph artifact object (with execution_hash, tool_id, chain.chain_depth) or a bare 64-hex / sha256:-prefixed hash string. Order is preserved as Merkle leaf order. Leaf execution hashes are hex-normalised (the sha256: prefix is stripped for tree hashing).

Session Receipt

Merkle Root & Chain-Depth Map

session_receipt_root:—

tree leaves / depth:—

max_chain_depth:—

Per-Receipt Inclusion Proofs

Leaf #	tool_id	chain_depth	execution_hash (leaf)	inclusion_proof (sibling path → root)

OpenChainGraph Artifact · execution_hash

execution_hash:—

Computed client-side via WebCrypto SHA-256 over cgCanon({policy_parameters, output_payload}) per Standard §6. Parent hashes: none