[FEAT] Tamper-evident receipt layer for AI agent tool calls — EU AI Act Article 12 compliance

[arian-gogani]

Problem

Flowise is used to build and deploy AI agents in production. When an agent calls a tool — web search, database query, API call, file operation — the only record of what happened lives in Flowise's platform logs or user-configured logging outputs.

For enterprise users deploying Flowise in regulated industries (finance, healthcare, legal, government), this isn't sufficient. EU AI Act Article 12 (enforcement August 2, 2026) requires tamper-evident automatic logging that an auditor can verify independently of the operator.

What's needed

A receipt layer that generates Ed25519-signed, hash-chained records for every agent tool call, verifiable offline without Flowise or any third-party service.

Integration point

The cleanest integration is an optional callback after tool execution in the agent's tool invocation path:

import { NobuAgent } from '@nobulex/core'

const nobu = new NobuAgent({ agentId: 'flowise-agent' })

// After each tool call in the agent chain
async function onToolComplete(toolName: string, args: object, result: string) {
  const receipt = await nobu.signReceipt({
    actionType: toolName,
    scope: JSON.stringify(args)
  })
  // Ed25519 signed, hash-chained, independently verifiable
  // receipt.verify() returns true for anyone with the public key
  return result
}

Why this matters now

EU AI Act Article 12 enforcement: August 2, 2026 — 8 weeks away. Enterprise teams using Flowise in regulated environments are asking this question now.

The existing logging and observability tools don't satisfy 'tamper-evident' — they're operator-controlled and can be modified. Ed25519 + hash chain is the right shape.

Reference: npm install @nobulex/core / pip install nobulex — live on PyPI/npm, LangChain/CrewAI/Dify integrations shipping, OWASP-merged compliance mapping. Happy to contribute a Flowise integration example.