E-commerce flagship: A verified human authorized an AI agent's refund — verifiable offline.

An AI agent issued a €49 customer refund + credit note on order:demo-7421. Human approved. One signed composite receipt binds action + artifact + authorization. Re-verify in-browser or with the CLI. This demo defaults to the e-commerce scenario.

Agent Witness Protocol · e-commerce flagship · composite record · offline-verifiable

🤖

STEP 1 — AGENT ACTION

AI refund agent

Issues a €49.00 refund on order:demo-7421 and generates a credit-note PDF.

🧑‍⚖️

STEP 2 — HUMAN APPROVAL

Human approver (HITL)

Approves the refund through the dashboard. The approval is recorded against this exact intent.

🧾

STEP 3 — ONE RECEIPT

Witness record

Refund + credit-note + human approval, bound in one signed, tamper-evident record.

The witness record (decoded)

Profile

composite — action + document + authorization

Agent action

payment.refund → order:demo-7421

Credit note (artifact)

application/pdf, 205 bytes · sha256 340c6e3879a5d807…

Human approval

claim_class asserted-by — "a human approved via the recorded credential" (HITL)

Mandate check

ap2.payment_mandate · claim_class verified-against · result pass

Settlement

testnet / mock — no real money moved

Tamper with it:

Click Verify offline. The signature check runs entirely in your browser (Web Crypto Ed25519) — the same check the awp verify CLI performs. No network, no server.

What this proves — and what it does not

Tamper-evident, not tamper-proof. Alteration is detectable by anyone, offline — not prevented.
Integrity-since-witness only. It proves the record is unaltered since it was witnessed — not authenticity-at-origin, not completeness.
The human leg proves "a human approved via the recorded HITL credential." It does NOT prove the person is real, nor that a verified principal was cryptographically bound to this intent (WebAuthn / OpenID4VP binding is a later phase).
It is NOT identity-proofing, NOT eIDAS-qualified, and makes no claim of court-admissibility.
This demo uses testnet / mock payment data and a demo signing key. The schema, the signature, the Merkle proof, the checkpoint and the anchor are all real.

Re-verify independently: npx --yes agent-witness-protocol verify composite-receipt.json (offline). The same receipt PASSES; one flipped byte FAILS, naming the broken check. See README.md for what is real vs. demo-scaffolding.