Check a receipt yourself

What you get: proof, not a promise. You pick an event, and the witness chain tells you whether it was recorded, where, and whether a signed checkpoint covers it.

Every action in Quox travels in an envelope (AEE). WARD, the witness, writes each one into a hash chain, and regularly signs a checkpoint over the newest entries, called a tip. A receipt is that chain of custody for one envelope.

1. Find an envelope

find something to check Copy

$ quox aee query --before 2026-10-13T18:00:00Z --limit 3ID                            Type     From              To            Intent01M4V6QPP49M4GMTAJW8QZYZRK    event    agent.quoxflow    quox.audit    aocl.verify.passed01M4V6QPP2X82G6GFPZZK1P7XA    event    agent.quoxflow    quox.audit    quox.flow.node.completed01M4V6QPP13ZDYTPJ1VTD213A1    event    agent.quoxflow    quox.audit    quox.flow.trigger.schedule.fired$ quox aee get 01M4V6QPP2X82G6GFPZZK1P7XAv          1id         01M4V6QPP2X82G6GFPZZK1P7XAfrom       agent.quoxflowto         quox.audittype       eventintent     quox.flow.node.completedcorr       wf-sentinel-heartbeat-KK610VT9ts         2026-10-13T18:00:00.451Zpayload  nodeId: trigger  nodeName: Every 15 Minutes  nodeType: trigger:schedule

From a real run on our own install. These are the scheduled heartbeat workflow's own events.

--from, --to, --intent, --corr and --after narrow the search; --corr gives you every envelope of one conversation or run.

2. Verify it

verify one receipt Copy

$ quox governance ward verify --envelope 01M4V6QPP2X82G6GFPZZK1P7XAWARD Receipt: AEE 01M4V6QPP2X82G6GFPZZK1P7XA──────────────────────────────────────────────────────status             WITNESSEDchain_id           ward:org/quox/env/productionsource_kind        AEEsource_id          01M4V6QPP2X82G6GFPZZK1P7XAentry  ward_entry_id: d079468b-8022-45e1-b568-7375653d223b  seq: 4171157  witnessed_at: 2026-10-13T18:00:01.080Z  chain_hash: c9a763ebfdfbc3968db98c631f5fc90c02298c8e801135cc2ac88d084...covering_tip  tip_id: 57fad058-27c7-41ef-9b81-4456f7ce659e  tip_seq: 4171200  signed: yes  signature_verified: yes  timestamped: yes  key_id: f695fbcf6be7179bsegment_verified   44warnings           []

From a real run on our own install. Hashes shortened by the CLI.

Read it from the top:

• entry: the envelope was written into the chain at position 4171157, 0.6 seconds after it happened.
• covering_tip: a signed checkpoint at position 4171200 covers it. The signature checked out against key f695fbcf6be7179b, and the tip carries a timestamp.
• segment_verified 44: the 44 links between the entry and the tip were re-hashed and match. Changing any one of them would break this.

3. If you check too soon

A check made seconds after the event can come back before the next signed checkpoint. This one is also from a real run:

checked too soon Copy

# an event from a minute ago: recorded, but the next signed tip has not landed yet$ quox governance ward verify --envelope 01M4VFKM4TXXSA0835YP2SYDGTstatus        UNTIPPEDreason        NO_COVERING_TIP  seq: 4179664  message: entry is recorded and self-consistent but no signed tip c...

From real runs on our own install. Hashes shortened by the CLI.

• UNTIPPED is normal for something that just happened. Check again in a few minutes.

The command exits with code 0 for WITNESSED, and exits with code 1 when the receipt is not yet covered, so a script can gate on it.

What just happened

You read an event back from the server and asked the witness, not the agent, whether it was recorded. The answer rests on hashes and a signature you can check, not on anyone’s word. That is the whole point: you do not trust it, you check it.

Check it yourself

In the conversation, /proof does this for the last tool call, walking AEE, AOCL, the tool and WARD in order. To check a whole stretch of the chain rather than one receipt, see Check the chain has not been changed.

Undo

Nothing to undo: verifying only reads.

Next

• Check the chain has not been changed