The Anchored Receipts register holds 21 receipt families and 29 claim types, every one of them shipped in Dekimu Hub, and the specification for all of them is public under CC0 at github.com/dekimuhq/anchors-spec. A receipt is a small signed record of one thing that happened: consent given, data erased, authority delegated, an agent action taken. All of them share one wire format, ar.<noun>.v<N>, and anyone can check one at verify.dekimu.com without asking Dekimu for anything.
Fourteen families form the locked core: provenance, consent (with withdrawal and modification), retention (erasure, expiry, hold, anonymisation, archive and batch), lineage, notice, breach, subject rights, impact assessment, transfer, purpose, evaluation, attestation, delegation and tokenisation. Six are agent-era: action, quality, guard, grounding, trace (a flat v1 and a span-tree v2 that coexist) and PII redaction. The twenty-first is the compliance bundle, ar.compliance.v1, a workspace-level snapshot that references a RoPA register, a DPIA and obligation evidence by hash. The count reaches 29 claim types because some families carry more than one: consent has three, retention six, trace two.
Each family is tied to the obligation it evidences. Consent receipts map to GDPR Art. 7, erasure to Art. 17, breach to Arts. 33 and 34, transfers to Chapter V, provenance to AI Act Art. 53. The spec states those mappings as field-level correspondences, which is what they are. The action family's document on AI Act Arts. 12, 19 and 26 says so in its title: a field mapping, not a conformity assessment.
Every family uses the same envelope: JCS canonicalisation, an Ed25519 signature, a subject carried as a salted SHA-256 commit or null, and a claim-type discriminator drawn from a single public registry. New fields are additive and optional; a breaking change needs a new version number on the wire. The envelope is the reason one verifier can read all 21 families and the reason adding a family is deliberately tedious: the cross-family consistency tables are the single source of truth, and a new member updates every one of them.
verify.dekimu.com is that verifier. It checks a receipt against the issuer's registered key and the daily Merkle root. Issuer trust is published as a signed list; every version is mirrored in the append-only anchors-trusted-issuers-chain repository so anyone can replay the chain from genesis and detect a tampered link. Dekimu Hub is the reference implementation: it issues every family as the trusted issuer. dekimu-mcp mints self-signed receipts of the same shape locally, for any agent, with the issuer being you.
An open spec is admissibility, not a cherry on top. For a receipt to hold up, the other side's expert has to be able to check it without trusting the company that issued it.
The specification text is CC0, public domain: use it, fork it, embed it. The reference implementations are Apache-2.0. None of it is priced and none of it will be; receipts are infrastructure, and Dekimu's revenue is Hub and miniterms. The honest boundaries are printed in the spec rather than left to marketing. Anchors prove what happened, when, and who authorised it; they do not prove why. There is no blockchain here: no global ledger, no consensus, no gas. The receipts are tamper-evident by construction, alter anything and verification breaks, built from standard primitives (Ed25519, with ML-DSA-65 agility drafted for the next envelope version). The composition of those primitives is under external security review, and that review is pending, so this post describes what was built and how many, and claims nothing about conformance or strength that the review has not yet earned.
Everything Dekimu publishes as open source now lives on one page, dekimu.com/open-source: the Anchored Receipts specification (anchors-spec, CC0) and the append-only anchors-trusted-issuers-chain, the dekimu-mcp server and the agents.txt package on npm, regulation-as-code (legal obligations as typed predicates over an evidence corpus), and claude-memory (decaying file-based memory for Claude Code). All of it is MIT, Apache-2.0 or CC0; all of it interoperates with Dekimu Hub as the reference implementation; and verify.dekimu.com is the public verifier for the receipts Hub issues.
This post was drafted by an AI system from Dekimu's public engineering record and published with automated checks, without per-post human editing.
← Back to blog