AER-1 Middleware

Verifiable execution receipts for AI agent frameworks.

Implements IETF draft-zambo-aer1, an IETF Internet-Draft for verifiable AI agent execution receipts.

Status: the framework adapters have been validated end to end against the real framework SDKs (FastMCP, langchain-core, openai-agents, opentelemetry-sdk), and generated receipts pass the AER-1 conformance kit's core check against draft-zambo-aer1-10. Published on PyPI as aer1-middleware.

Tested against: cryptography 50.0.2, fastmcp 4.0.10, langchain-core 1.6.6, openai-agents 0.23.1, opentelemetry-sdk 1.45.0 (2026-10-04).

Installation

pip install aer1-middleware

Or install from source:

git clone https://gitlab.com/rambozambodotdev/zambo.git
cd zambo/aer1-middleware
pip install -e .

FastMCP (one line)

from fastmcp import FastMCP
from aer1_middleware.fastmcp import AER1Middleware

mcp = FastMCP("my-server")
mcp.add_middleware(AER1Middleware())  # That's it. Every tool call now generates a receipt.

LangChain (one line)

from langchain_openai import ChatOpenAI
from aer1_middleware.langchain import AER1Callback

llm = ChatOpenAI(callbacks=[AER1Callback()])

OpenAI Agents SDK (one decorator)

from agents import function_tool
from aer1_middleware.openai_agents import with_aer1

@function_tool
@with_aer1
def search(query: str) -> str:
    return f"Results for {query}"

(with_aer1 must wrap the raw function, so it goes directly above def, inside function_tool. Retrieve receipts with from aer1_middleware.openai_agents import get_receipts.)

OpenTelemetry (span exporter)

from aer1_middleware.otel import AER1SpanExporter

exporter = AER1SpanExporter()
exporter.export_receipt(receipt)

Manual usage

from aer1_middleware import create_receipt, verify_receipt

receipt = create_receipt(
    tool_name="search",
    inputs={"query": "AER-1"},
    output={"results": [...]},
)

is_valid, reason = verify_receipt(receipt)

What is AER-1?

AER-1 (Agent Execution Receipt v1) is an IETF Internet-Draft for verifiable records of AI agent tool executions. Each receipt contains:

• SHA-256 commitment over the canonical tool-call payload
• Timestamp and unique IDs
• Optional Ed25519 signature
• Independently verifiable against the conformance kit

A receipt lets anyone check that the decoded bytes match the recorded commitment. It does not prove the model was right, and it does not by itself prove an external outcome.

License

MIT