treeship-commerce 0.28.0__tar.gz

treeship_commerce-0.28.0/PKG-INFO

@@ -0,0 +1,119 @@
+Metadata-Version: 2.4
+Name: treeship-commerce
+Version: 0.28.0
+Summary: Signed, offline-verifiable receipts for every tool call in anthropics/commerce-agents, on all three of its runtimes.
+License: Apache-2.0
+Project-URL: Homepage, https://treeship.dev
+Project-URL: Documentation, https://docs.treeship.dev/integrations/commerce-agents
+Project-URL: Source, https://github.com/zerkerlabs/treeship/tree/main/integrations/commerce-agents
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: treeship-sdk>=0.27.0
+
+# Treeship for Claude Commerce Agents
+
+Signed, offline-verifiable receipts for every tool call in
+[anthropics/commerce-agents](https://github.com/anthropics/commerce-agents), on all three of
+its runtimes.
+
+The reference draws its own boundary in `docs/safety.md`: the approval surface, payment,
+and log hygiene are "what a deployment owns". This package is what a deployment adds for
+the record of what happened. It records; it does not gate. The reference's provenance
+gates, caps, and host approval still decide what runs.
+
+## What it does
+
+`commerce_common.execution.BaseToolExecutor.execute` is the one method every tool call
+passes through on the Messages API, the Agent SDK, and Managed Agents. `TreeshipExecutorMixin`
+overrides it:
+
+1. a signed **intent** receipt before dispatch: tool, SHA-256 of the canonical arguments,
+   session tag;
+2. the tool, exactly as the reference runs it;
+3. a signed **result** receipt: status (`ok`, `blocked` with the gate's name, `error`),
+   SHA-256 of the result text, event types, timing.
+
+Each receipt names its parent, so a session reads `intent → result → intent → result …` from
+the Treeship session's root, and `treeship verify` walks it as one chain. A held call is a
+signed refusal, not a missing receipt.
+
+Never written: the arguments, the result text (fenced third-party content on the
+reference), or the commerce session id (the request credential). The receipt carries the
+same twelve-hex session tag the reference's own log lines use, so an operator holding the id
+can correlate and a reader cannot.
+
+## Install
+
+```bash
+# from a clone of anthropics/commerce-agents, with its venv active
+pip install -r requirements.txt            # their seven packages (unregistered on PyPI)
+pip install treeship-sdk
+pip install "treeship-commerce @ git+https://github.com/zerkerlabs/treeship.git#subdirectory=integrations/commerce-agents"   # PyPI publication follows the next release
+curl -fsSL https://treeship.dev/install | sh && treeship init
+```
+
+## Use
+
+```python
+from treeship_sdk import Treeship
+from treeship_commerce import TreeshipReceipts, attach, receipted
+from treeship_commerce.lifecycle import close_session, start_session
+from shopping_agent.executor import ShoppingToolExecutor
+
+ts = Treeship()
+root = start_session(ts, name="storefront:acme", actor="agent://shopping")
+
+executor = receipted(ShoppingToolExecutor)(backend=..., config=..., skills=..., session=..., state=..., memory=...)
+attach(executor, TreeshipReceipts(ts, actor="agent://shopping", session_id=session.session_id, parent_id=root))
+
+# ... the runtime calls executor.execute(...) as it always did ...
+
+close_session(ts, summary="...")          # seals a .treeship package; `treeship session report` publishes it
+```
+
+All three runtimes construct executors themselves through `executor_class`
+(`ShoppingAgent`, `ShoppingToolset`, the MCP server's `build_server`). Give
+`receipted()` a `recorder` factory and each executor gets its own recorder on
+its first tool call:
+
+```python
+ReceiptedShopping = receipted(ShoppingToolExecutor, recorder=lambda ex: TreeshipReceipts(
+    ts, actor="agent://shopping", session_id=ex._session.session_id, parent_id=root))
+```
+
+Same for `MerchantToolExecutor`.
+
+Recording never breaks the agent path: a receipt that cannot be written warns once, is
+counted in `TreeshipReceipts.dropped`, and later results say `intent_recorded: false` where
+the intent is missing. Nothing is invented. `TREESHIP_DISABLE=1` turns recording off.
+
+## Demo
+
+```bash
+TREESHIP_BIN=... python -m treeship_commerce.demo
+```
+
+Runs the reference's shopping executor over the retail mock with no model and no API key:
+a search, a product read, an add, an add the provenance gate holds, a checkout hand-off.
+Prints every receipt id, seals the session, and shows the `treeship verify` command.
+
+## What this does not do (yet)
+
+- **Approvals.** The merchant `apply_change` gate checks a mark the host sets. Turning that
+  mark into a signed, single-use Treeship approval (nonce echoed by the apply receipt,
+  enforced by the Approval Use Journal) is the next piece.
+- **Checkout hand-off receipt.** Signing the cart digest and hosted-checkout URL digest at
+  `checkout_handoff`, chained to the host's order placement.
+- **Prove the work is correct.** A receipt is evidence of what ran and what the gates
+  decided. It does not make a wrong answer right.
+
+## Tests
+
+```bash
+TREESHIP_BIN=/path/to/treeship python -m pytest
+```
+
+Six cases on a real isolated ship and the real retail mock: chain order and linkage, a held
+call signed as blocked with its gate, digests-only content, recording failure leaving the
+tool untouched, `TREESHIP_DISABLE`, and `attach` refusing an executor that would record
+nothing.

treeship_commerce-0.28.0/README.md

@@ -0,0 +1,107 @@
+# Treeship for Claude Commerce Agents
+
+Signed, offline-verifiable receipts for every tool call in
+[anthropics/commerce-agents](https://github.com/anthropics/commerce-agents), on all three of
+its runtimes.
+
+The reference draws its own boundary in `docs/safety.md`: the approval surface, payment,
+and log hygiene are "what a deployment owns". This package is what a deployment adds for
+the record of what happened. It records; it does not gate. The reference's provenance
+gates, caps, and host approval still decide what runs.
+
+## What it does
+
+`commerce_common.execution.BaseToolExecutor.execute` is the one method every tool call
+passes through on the Messages API, the Agent SDK, and Managed Agents. `TreeshipExecutorMixin`
+overrides it:
+
+1. a signed **intent** receipt before dispatch: tool, SHA-256 of the canonical arguments,
+   session tag;
+2. the tool, exactly as the reference runs it;
+3. a signed **result** receipt: status (`ok`, `blocked` with the gate's name, `error`),
+   SHA-256 of the result text, event types, timing.
+
+Each receipt names its parent, so a session reads `intent → result → intent → result …` from
+the Treeship session's root, and `treeship verify` walks it as one chain. A held call is a
+signed refusal, not a missing receipt.
+
+Never written: the arguments, the result text (fenced third-party content on the
+reference), or the commerce session id (the request credential). The receipt carries the
+same twelve-hex session tag the reference's own log lines use, so an operator holding the id
+can correlate and a reader cannot.
+
+## Install
+
+```bash
+# from a clone of anthropics/commerce-agents, with its venv active
+pip install -r requirements.txt            # their seven packages (unregistered on PyPI)
+pip install treeship-sdk
+pip install "treeship-commerce @ git+https://github.com/zerkerlabs/treeship.git#subdirectory=integrations/commerce-agents"   # PyPI publication follows the next release
+curl -fsSL https://treeship.dev/install | sh && treeship init
+```
+
+## Use
+
+```python
+from treeship_sdk import Treeship
+from treeship_commerce import TreeshipReceipts, attach, receipted
+from treeship_commerce.lifecycle import close_session, start_session
+from shopping_agent.executor import ShoppingToolExecutor
+
+ts = Treeship()
+root = start_session(ts, name="storefront:acme", actor="agent://shopping")
+
+executor = receipted(ShoppingToolExecutor)(backend=..., config=..., skills=..., session=..., state=..., memory=...)
+attach(executor, TreeshipReceipts(ts, actor="agent://shopping", session_id=session.session_id, parent_id=root))
+
+# ... the runtime calls executor.execute(...) as it always did ...
+
+close_session(ts, summary="...")          # seals a .treeship package; `treeship session report` publishes it
+```
+
+All three runtimes construct executors themselves through `executor_class`
+(`ShoppingAgent`, `ShoppingToolset`, the MCP server's `build_server`). Give
+`receipted()` a `recorder` factory and each executor gets its own recorder on
+its first tool call:
+
+```python
+ReceiptedShopping = receipted(ShoppingToolExecutor, recorder=lambda ex: TreeshipReceipts(
+    ts, actor="agent://shopping", session_id=ex._session.session_id, parent_id=root))
+```
+
+Same for `MerchantToolExecutor`.
+
+Recording never breaks the agent path: a receipt that cannot be written warns once, is
+counted in `TreeshipReceipts.dropped`, and later results say `intent_recorded: false` where
+the intent is missing. Nothing is invented. `TREESHIP_DISABLE=1` turns recording off.
+
+## Demo
+
+```bash
+TREESHIP_BIN=... python -m treeship_commerce.demo
+```
+
+Runs the reference's shopping executor over the retail mock with no model and no API key:
+a search, a product read, an add, an add the provenance gate holds, a checkout hand-off.
+Prints every receipt id, seals the session, and shows the `treeship verify` command.
+
+## What this does not do (yet)
+
+- **Approvals.** The merchant `apply_change` gate checks a mark the host sets. Turning that
+  mark into a signed, single-use Treeship approval (nonce echoed by the apply receipt,
+  enforced by the Approval Use Journal) is the next piece.
+- **Checkout hand-off receipt.** Signing the cart digest and hosted-checkout URL digest at
+  `checkout_handoff`, chained to the host's order placement.
+- **Prove the work is correct.** A receipt is evidence of what ran and what the gates
+  decided. It does not make a wrong answer right.
+
+## Tests
+
+```bash
+TREESHIP_BIN=/path/to/treeship python -m pytest
+```
+
+Six cases on a real isolated ship and the real retail mock: chain order and linkage, a held
+call signed as blocked with its gate, digests-only content, recording failure leaving the
+tool untouched, `TREESHIP_DISABLE`, and `attach` refusing an executor that would record
+nothing.

treeship_commerce-0.28.0/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "treeship-commerce"
+version = "0.28.0"
+description = "Signed, offline-verifiable receipts for every tool call in anthropics/commerce-agents, on all three of its runtimes."
+readme = "README.md"
+license = { text = "Apache-2.0" }
+requires-python = ">=3.11"
+dependencies = ["treeship-sdk>=0.27.0"]
+# The commerce-agents packages (commerce-common, shopping-agent-core, ...) are
+# deliberately unregistered on PyPI; install them from a clone first
+# (`pip install -r requirements.txt` in anthropics/commerce-agents). This
+# package imports them lazily and says so when they are missing.
+
+[project.urls]
+Homepage = "https://treeship.dev"
+Documentation = "https://docs.treeship.dev/integrations/commerce-agents"
+Source = "https://github.com/zerkerlabs/treeship/tree/main/integrations/commerce-agents"
+
+[tool.setuptools.packages.find]
+include = ["treeship_commerce*"]
+
+[tool.pytest.ini_options]
+addopts = "-p asyncio"
+asyncio_mode = "auto"
+testpaths = ["tests"]

treeship_commerce-0.28.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

treeship_commerce-0.28.0/tests/test_receipts.py

@@ -0,0 +1,270 @@
+# Every test here would pass for the wrong reason if it only checked that
+# execute() returned. Each one names the receipt property it exists for.
+
+from __future__ import annotations
+
+import json
+
+import pytest
+from treeship_sdk import Treeship
+
+from treeship_commerce import TreeshipReceipts, args_digest, attach, receipted
+from treeship_commerce.receipts import TreeshipExecutorMixin
+
+from .conftest import COMMERCE_SESSION_ID, Ship, needs_cli
+
+pytestmark = needs_cli
+
+
+async def _first_product(executor) -> str:
+    outcome = await executor.execute("search_products", {"query": "tent"})
+    assert not outcome.refused, outcome.result_text
+    seen = list(executor._state.seen_products)
+    assert seen, "the retail mock returned no products for 'tent'"
+    return seen[0]
+
+
+async def test_intent_precedes_result_and_chains_from_the_session_root(ship: Ship, executor):
+    product = await _first_product(executor)
+    outcome = await executor.execute("add_to_cart", {"product_id": product, "quantity": 1})
+    assert not outcome.refused, outcome.result_text
+
+    receipts: TreeshipReceipts = executor.treeship_receipts
+    assert receipts.dropped == 0
+    assert len(receipts.recorded) == 4  # intent, result, intent, result
+
+    chain = ship.chain(receipts.head)
+    actions = [c["statement"]["action"] for c in chain]
+    assert (
+        actions[0].startswith("session.start")
+        or chain[0]["record"]["artifact_id"] == ship.session_root
+    )
+    assert actions[1:] == [
+        "commerce.tool.search_products.intent",
+        "commerce.tool.search_products.result",
+        "commerce.tool.add_to_cart.intent",
+        "commerce.tool.add_to_cart.result",
+    ]
+    # Each result's parent is its own intent, so a result can never be read as
+    # belonging to a different call.
+    for intent, result in zip(chain[1::2], chain[2::2], strict=True):
+        assert result["statement"]["parentId"] == intent["record"]["artifact_id"]
+
+    verdict = ship.cli_json("verify", receipts.head)
+    assert verdict["outcome"] == "pass", verdict
+    assert verdict["chain_linkage_ok"] is True
+    assert verdict["total"] == 5  # root + 4
+
+    status = ship.cli_json("session", "status")
+    assert status["receipts"] == 4
+    # One timeline event per tool call -- when the SDK can append them. On
+    # treeship-sdk 0.27.0 (no session_event) the timeline stays at the
+    # session-start event and the signed receipts are the only record.
+    expected_events = 1 + (2 if hasattr(ship.client, "session_event") else 0)
+    assert status["events"] == expected_events
+
+
+async def test_a_held_call_is_signed_as_blocked_with_the_gate_named(ship: Ship, executor):
+    from shopping_agent.gates import PROVENANCE_GATE
+
+    outcome = await executor.execute("add_to_cart", {"product_id": "p-never-seen", "quantity": 1})
+    assert outcome.blocked == PROVENANCE_GATE  # the reference's gate did its job
+
+    receipts: TreeshipReceipts = executor.treeship_receipts
+    result = ship.artifacts()[receipts.head]["statement"]
+    assert result["action"] == "commerce.tool.add_to_cart.result"
+    meta = result["meta"]
+    assert meta["status"] == "blocked"
+    assert meta["gate"] == PROVENANCE_GATE
+    assert meta["intent_recorded"] is True
+    # Blocked is still a pass for the signature: the receipt is authentic
+    # evidence of a refusal, not a failed receipt.
+    assert ship.cli_json("verify", receipts.head)["outcome"] == "pass"
+
+
+async def test_receipts_carry_digests_never_arguments_results_or_the_session_id(
+    ship: Ship, executor
+):
+    product = await _first_product(executor)
+    await executor.execute("get_product_details", {"product_id": product})
+    receipts: TreeshipReceipts = executor.treeship_receipts
+
+    arts = ship.artifacts()
+    for artifact_id in receipts.recorded:
+        raw = arts[artifact_id]["raw"]
+        statement = arts[artifact_id]["statement"]
+        assert COMMERCE_SESSION_ID not in raw, "the commerce session id is a credential"
+        assert '"tent"' not in raw, "raw arguments must not appear in a receipt"
+        assert "storefront_data" not in raw, "fenced result text must not appear in a receipt"
+        meta = statement["meta"]
+        assert (
+            meta["session_tag"]
+            == __import__("hashlib").sha256(COMMERCE_SESSION_ID.encode()).hexdigest()[:12]
+        )
+
+    intent = arts[receipts.recorded[0]]["statement"]
+    assert intent["meta"]["args_digest"] == args_digest({"query": "tent"})
+    details_result = arts[receipts.recorded[-1]]["statement"]
+    assert details_result["meta"]["result_digest"].startswith("sha256:")
+    assert details_result["meta"]["events"] == []
+
+
+async def test_recording_failure_never_breaks_the_tool_and_is_counted(ship: Ship, executor):
+    # Point the recorder at a binary that does not exist. The tool must still
+    # run and return its real outcome; the recorder must count what it lost
+    # rather than pretend.
+    broken = Treeship(cli_path=str(ship.root / "no-such-treeship"), env=ship.env, cwd=ship.root)
+    attach(
+        executor,
+        TreeshipReceipts(
+            broken,
+            actor="agent://shopping",
+            session_id=COMMERCE_SESSION_ID,
+            parent_id=ship.session_root,
+        ),
+    )
+    outcome = await executor.execute("search_products", {"query": "tent"})
+    assert not outcome.refused
+    assert "tent" in outcome.result_text.lower() or executor._state.seen_products
+    receipts: TreeshipReceipts = executor.treeship_receipts
+    assert receipts.recorded == []
+    assert receipts.dropped >= 2  # intent + result (+ timeline event)
+    assert receipts.head == ship.session_root  # the chain head never moved to a phantom id
+
+
+async def test_disabled_records_nothing_and_changes_nothing(ship: Ship, executor, monkeypatch):
+    monkeypatch.setenv("TREESHIP_DISABLE", "1")
+    before = set(ship.artifacts())
+    outcome = await executor.execute("search_products", {"query": "tent"})
+    assert not outcome.refused
+    assert set(ship.artifacts()) == before
+    assert executor.treeship_receipts.recorded == []
+    assert executor.treeship_receipts.dropped == 0
+
+
+async def test_attach_refuses_an_executor_that_would_record_nothing(ship: Ship):
+    from commerce_common.memory import InMemoryMemoryStore
+    from commerce_common.skills import SkillRegistry
+    from shopping_agent import ShoppingAgentConfig, ShoppingSessionContext, ShoppingSessionState
+    from shopping_agent.executor import ShoppingToolExecutor, build_memory
+    from shopping_agent_sdk import load_mock_backend
+
+    config = ShoppingAgentConfig(brand_name="ACME")
+    plain = ShoppingToolExecutor(
+        backend=load_mock_backend(),
+        config=config,
+        skills=SkillRegistry([]),
+        session=ShoppingSessionContext(session_id="s", user_id="u"),
+        state=ShoppingSessionState(),
+        memory=build_memory(config, InMemoryMemoryStore()),
+        inline_context=True,
+    )
+    with pytest.raises(TypeError):
+        attach(plain, TreeshipReceipts(ship.client, actor="agent://shopping"))
+
+
+def test_receipted_puts_the_mixin_first_and_is_idempotent():
+    from shopping_agent.executor import ShoppingToolExecutor
+
+    cls = receipted(ShoppingToolExecutor)
+    assert cls.__mro__[1] is TreeshipExecutorMixin
+    assert issubclass(cls, ShoppingToolExecutor)
+    assert receipted(cls) is cls
+
+
+def test_args_digest_is_canonical():
+    assert args_digest({"b": 1, "a": "x"}) == args_digest({"a": "x", "b": 1})
+    assert args_digest({}) == args_digest(None)
+    assert args_digest({"a": 1}) != args_digest({"a": 2})
+    assert json.dumps({"a": 1}) and args_digest({"a": 1}).startswith("sha256:")
+
+
+async def test_a_recorder_factory_gives_each_executor_its_own_chain(ship: Ship):
+    # The runtimes construct executors themselves through `executor_class`,
+    # so the factory is the only way to record there. Two executors, two
+    # commerce sessions, two recorders, two tags -- never one shared chain.
+    from commerce_common.memory import InMemoryMemoryStore
+    from commerce_common.skills import SkillRegistry
+    from shopping_agent import ShoppingAgentConfig, ShoppingSessionContext, ShoppingSessionState
+    from shopping_agent.executor import ShoppingToolExecutor, build_memory
+    from shopping_agent_sdk import load_mock_backend
+
+    config = ShoppingAgentConfig(brand_name="ACME")
+    cls = receipted(
+        ShoppingToolExecutor,
+        recorder=lambda ex: TreeshipReceipts(
+            ship.client,
+            actor="agent://shopping",
+            session_id=ex._session.session_id,
+            parent_id=ship.session_root,
+        ),
+    )
+
+    def build(session_id: str):
+        return cls(
+            backend=load_mock_backend(),
+            config=config,
+            skills=SkillRegistry([]),
+            session=ShoppingSessionContext(session_id=session_id, user_id="u"),
+            state=ShoppingSessionState(),
+            memory=build_memory(config, InMemoryMemoryStore()),
+            inline_context=True,
+        )
+
+    a, b = build("session-A"), build("session-B")
+    assert a.treeship_receipts is None  # nothing recorded until the first call
+    await a.execute("search_products", {"query": "tent"})
+    await b.execute("search_products", {"query": "tent"})
+    assert a.treeship_receipts is not b.treeship_receipts
+    assert a.treeship_receipts.session_tag != b.treeship_receipts.session_tag
+    assert len(a.treeship_receipts.recorded) == 2 and len(b.treeship_receipts.recorded) == 2
+    for ex in (a, b):
+        assert ship.cli_json("verify", ex.treeship_receipts.head)["outcome"] == "pass"
+
+
+class _OldSdkClient:
+    """A treeship-sdk 0.27.0 client: attest_action exists, session_event does not."""
+
+    def __init__(self, inner):
+        self._inner = inner
+
+    def attest_action(self, *args, **kwargs):
+        return self._inner.attest_action(*args, **kwargs)
+
+
+async def test_an_sdk_without_session_event_still_writes_signed_receipts(ship: Ship, executor):
+    # The SDK on PyPI at launch (0.27.0) predates session_event(). The
+    # receipts are the evidence; the timeline must degrade, never raise into
+    # the tool call. Before this guard, AttributeError escaped execute().
+    attach(
+        executor,
+        TreeshipReceipts(
+            _OldSdkClient(ship.client),
+            actor="agent://shopping",
+            session_id=COMMERCE_SESSION_ID,
+            parent_id=ship.session_root,
+        ),
+    )
+    outcome = await executor.execute("search_products", {"query": "tent"})
+    assert not outcome.refused
+    receipts: TreeshipReceipts = executor.treeship_receipts
+    assert len(receipts.recorded) == 2 and receipts.dropped == 0
+    assert ship.cli_json("verify", receipts.head)["outcome"] == "pass"
+
+
+async def test_a_client_that_raises_anything_never_breaks_the_tool(ship: Ship, executor):
+    class Explodes:
+        def attest_action(self, *a, **k):
+            raise RuntimeError("simulated SDK bug")
+
+        def session_event(self, *a, **k):
+            raise KeyError("simulated SDK bug")
+
+    attach(
+        executor,
+        TreeshipReceipts(Explodes(), actor="agent://shopping", parent_id=ship.session_root),
+    )
+    outcome = await executor.execute("search_products", {"query": "tent"})
+    assert not outcome.refused
+    assert executor.treeship_receipts.recorded == []
+    assert executor.treeship_receipts.dropped >= 2

treeship_commerce-0.28.0/tests/test_runtimes.py

@@ -0,0 +1,118 @@
+# The docs say one wrapper covers all three of the reference's runtimes
+# through `executor_class`. Each test here drives a runtime the way the
+# reference's own tests drive it and checks that receipts were written, so
+# that claim is tested, not inferred from reading the source.
+
+from __future__ import annotations
+
+import sys
+
+from treeship_commerce import TreeshipReceipts, receipted
+
+from .conftest import Ship, needs_cli
+
+pytestmark = needs_cli
+
+
+def _factory(ship: Ship, made: list[TreeshipReceipts]):
+    def make(executor) -> TreeshipReceipts:
+        r = TreeshipReceipts(
+            ship.client,
+            actor="agent://shopping",
+            session_id=executor._session.session_id,
+            parent_id=ship.session_root,
+        )
+        made.append(r)
+        return r
+
+    return make
+
+
+def _receipted_shopping(ship: Ship, made: list[TreeshipReceipts]):
+    from shopping_agent.executor import ShoppingToolExecutor
+
+    return receipted(ShoppingToolExecutor, recorder=_factory(ship, made))
+
+
+async def test_messages_api_runtime_records_through_executor_class(ship: Ship):
+    from commerce_common.skills import SkillRegistry
+    from commerce_common.testing import FakeClient, text_message, tool_use_message
+    from shopping_agent import ShoppingSessionContext, ShoppingSessionState
+    from shopping_agent_runtime import ShoppingAgent
+    from shopping_agent_sdk import load_mock_backend
+
+    made: list[TreeshipReceipts] = []
+    # A scripted model: one tool call, then a text answer. No API key.
+    client = FakeClient(
+        [tool_use_message("search_products", {"query": "tent"}), text_message("Here.")]
+    )
+    agent = ShoppingAgent(
+        backend=load_mock_backend(),
+        skills=SkillRegistry([]),
+        client=client,
+        executor_class=_receipted_shopping(ship, made),
+    )
+    session = ShoppingSessionContext(session_id="messages-api-session", user_id="u-1")
+    state = ShoppingSessionState()
+    events = [
+        e async for e in agent.stream_turn([{"role": "user", "content": "a tent"}], session, state)
+    ]
+    assert any(e.type == "tool_call" for e in events), [e.type for e in events]
+    assert len(made) == 1, "one executor per turn, one recorder"
+    assert [a.split(".")[-1] for a in _actions(ship, made[0])] == ["intent", "result"]
+    assert ship.cli_json("verify", made[0].head)["outcome"] == "pass"
+
+
+async def test_agent_sdk_toolset_records_through_executor_class(ship: Ship):
+    from shopping_agent_sdk import (
+        ShoppingToolset,
+        build_shopping_sdk_tools,
+        default_config,
+        load_mock_backend,
+    )
+
+    made: list[TreeshipReceipts] = []
+    toolset = ShoppingToolset(
+        backend=load_mock_backend(),
+        config=default_config(),
+        executor_class=_receipted_shopping(ship, made),
+    )
+    handlers = {t.name: t for t in build_shopping_sdk_tools(toolset)}
+    await handlers["search_products"].handler({"query": "headphones"})
+    held = await handlers["add_to_cart"].handler(
+        {"product_id": "AR-0000-never-seen", "quantity": 1}
+    )
+    assert held is not None
+    assert len(made) == 1
+    actions = [a.split(".")[-1] for a in _actions(ship, made[0])]
+    assert actions == ["intent", "result", "intent", "result"]
+    last = ship.artifacts()[made[0].head]["statement"]["meta"]
+    assert last["status"] == "blocked" and last["gate"] == "provenance"
+    assert ship.cli_json("verify", made[0].head)["outcome"] == "pass"
+
+
+async def test_managed_agents_mcp_server_records_through_executor_class(ship: Ship):
+    from commerce_common.memory import InMemoryMemoryStore
+    from mcp.shared.memory import create_connected_server_and_client_session
+    from shopping_agent_sdk import REPO_ROOT
+
+    sys.path.insert(
+        0, str(REPO_ROOT / "shopping-agent" / "managed-agents" / "storefront-mcp-server")
+    )
+    from storefront_mcp_server import build_server
+
+    made: list[TreeshipReceipts] = []
+    server = build_server(
+        memory_store=InMemoryMemoryStore(), executor_class=_receipted_shopping(ship, made)
+    )
+    async with create_connected_server_and_client_session(server._mcp_server) as client:
+        await client.call_tool("search_products", {"query": "yoga mat"})
+        await client.call_tool("search_products", {"query": "headphones"})
+    assert len(made) == 1, "one executor, and so one recorder, per MCP connection"
+    assert len(made[0].recorded) == 4
+    assert ship.cli_json("verify", made[0].head)["outcome"] == "pass"
+
+
+def _actions(ship: Ship, receipts: TreeshipReceipts) -> list[str]:
+    arts = ship.artifacts()
+    return [arts[i]["statement"]["action"] for i in receipts.recorded]

treeship_commerce-0.28.0/treeship_commerce/__init__.py

@@ -0,0 +1,26 @@
+"""Treeship receipts for anthropics/commerce-agents.
+
+One shared executor runs every tool call on all three commerce-agents
+runtimes (Messages API, Agent SDK, Managed Agents). Wrapping it once gives
+every call a signed intent receipt before it runs and a signed result
+receipt after, chained from the session's root. See ``receipts.py``.
+"""
+
+from .receipts import (
+    TreeshipExecutorMixin,
+    TreeshipReceipts,
+    args_digest,
+    attach,
+    receipted,
+    text_digest,
+)
+
+__all__ = [
+    "TreeshipExecutorMixin",
+    "TreeshipReceipts",
+    "args_digest",
+    "attach",
+    "receipted",
+    "text_digest",
+]
+__version__ = "0.28.0"