Sign at the seam. Chain. Seal. Verify anywhere.
Treeship does not gate. Your rules, the blueprint's gates, the network's authorization keep deciding what runs. Treeship signs what they decided, at the moment they decided it, and chains each receipt to the one before.
Sign at the seam
The one method every tool call passes through, the click that sets an approval, the moment the cart meets checkout. A receipt before, a receipt after, digests only.
Chain and seal
Every receipt names its parent. Closing the session folds them into a signed Merkle root and a portable package with its own verification page.
Verify anywhere
treeship verify on any machine, the browser verifier on the receipt page, or your own code against the reference verifier. No account, no network, no trust in us.
Refused by the gate. Approved once. Verified offline.
Both demos recorded on Anthropic's mock backends, no model, no API key, then the sealed session's own receipt page. Every id is real.
python -m treeship_commerce.demo. A product id the agent never saw in a catalog read is pushed at the cart; the reference's provenance gate refuses it, and the refusal is inside the signed receipt, not a log line. treeship package verify then proves the refused add is in the sealed tree.
python -m treeship_commerce.demo_merchant, then treeship package verify and treeship approval uses. Every id shown is real..treeship package's own page, verifying in the browser with no network and no server. The approval gate reads from the same evidence package verify checks.Checkable on any machine.
Without asking us.
Every receipt is a DSSE envelope signed with Ed25519, content-addressed, chained to its parent, and folded into a signed Merkle checkpoint when the session seals. treeship verify walks the chain offline against your own pinned roots. A published session renders at a permanent receipt URL with the same verifier running in the browser. The hub stores bytes and serves proofs; it never issues a verdict.
What a receipt proves: this key signed, at that time, that this tool was about to run with arguments of that digest, and then what the gate decided. What it does not prove: that the answer was correct. A wrong answer with a perfect receipt is still wrong. Treeship authenticates statements; it does not adjudicate commerce.
The trust boundary
Receipt your storefront.
Whatever it runs on.
On Anthropic's reference, pass the receipted executor_class and nothing else changes. On anything else, the CLI, the MCP bridge or the A2A bridge sign the same seams.