Skip to content

docs(lesson-18): add nobulex Python receipt SDK to production references#571

Open
arian-gogani wants to merge 2 commits into
microsoft:mainfrom
arian-gogani:main
Open

docs(lesson-18): add nobulex Python receipt SDK to production references#571
arian-gogani wants to merge 2 commits into
microsoft:mainfrom
arian-gogani:main

Conversation

@arian-gogani

Copy link
Copy Markdown

What

Adds nobulex to the production library references in Lesson 18 (Securing AI Agents with Cryptographic Receipts).

The lesson currently lists two npm packages (protect-mcp and @veritasacta/verify) as production receipt library options. nobulex fills the same role for Python, which has no library listed.

Why

  • pip install nobulex is live on PyPI
  • Same primitives as the lesson's from-scratch implementation (Ed25519 / JCS RFC 8785 / SHA-256 hash chain)
  • LangChain and CrewAI integrations built in
  • 4/4 cross-validation vectors pass byte-identical against TypeScript implementation
  • OWASP CheatSheetSeries PR #2210 (AML and Sanctions Compliance for AI Agent Payments) was merged June 2026 with nobulex's JCS canonicalization rationale and EU AI Act compliance mapping in Sections 8-11

Change

One bullet added to the 'Use a production receipt library' list in the Production References section. No other changes.

Copilot AI review requested due to automatic review settings June 4, 2026 23:20
@github-actions

github-actions Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

👋 Thanks for contributing @arian-gogani! We will review the pull request and get back to you soon.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds an additional external reference in the “receipts / tamper-evident audit trail” resources list, pointing readers to a Python SDK option aligned with the lesson’s signing/verification pattern.

Changes:

  • Add a new README bullet referencing the nobulex Python SDK and related compliance/test-vector claims.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread 18-securing-ai-agents/README.md Outdated
- The receipt format used in this lesson follows an IETF Internet-Draft (`draft-farley-acta-signed-receipts`) currently in the standards process.
- The Microsoft Agent Governance Toolkit composes receipts with Cedar-based policy decisions; see Tutorial 33 in that repository for an end-to-end example.
- The `protect-mcp` (npm) and `@veritasacta/verify` (npm) packages provide a Node-based implementation of receipt signing and offline verification, intended for wrapping any MCP server with a tamper-evident audit trail.
- The **[nobulex](https://github.com/arian-gogani/nobulex)** Python SDK (`pip install nobulex`) provides the same pattern in Python with LangChain and CrewAI integrations, cross-validated test vectors (4/4 byte-identical across Python and TypeScript), and an OWASP-merged compliance mapping for EU AI Act Article 12, SOC 2, and HIPAA (see [PR #2210](https://github.com/OWASP/CheatSheetSeries/pull/2210), merged June 2026).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants