Audit trail for the OpenAI Agents SDK

Wrap the function tools you give an agent and each call is written as a signed, chained record: a decision before the tool runs and an outcome after it. Python and TypeScript.

Full steps: Python quickstart, TypeScript quickstart. What recording covers and where it stops: Tool coverage.

The change #

One call where the agent gets its tools. wrap_tools takes @function_tool tools and wrapTools takes tool({...}) from @openai/agents. The agent, the runner and the tools' schemas stay as they are, and the Agents SDK is not a dependency of the SDK.

import signafaide
from agents import Agent

tools = signafaide.wrap_tools(
    [lookup_order, refund], agent="support-bot"
)
agent = Agent(name="support", tools=tools)

import { wrapTools } from "signafaide";
import { Agent } from "@openai/agents";

const tools = wrapTools([lookupOrder, refund], {
  agent: "support-bot",
});
const agent = new Agent({ name: "support", tools });

A verify run #

Run the agent once, then signafaide verify (npx signafaide verify in a TypeScript project). This is a local run in which the agent called refund once: three records for the tool list, one decision and one outcome.

$ signafaide verify
local state: /home/dev/support-agent/.signafaide
 1. Envelope schema              PASS         5 records
 2. Record hashes                NOT CHECKED  0 records; 5 not yet shipped (no receipt); nothing co-signed yet
 3. Client signatures            PASS         5 records
 4. Agent chains                 PASS         5 records
 5. Merkle proofs                NOT CHECKED  0 records; nothing co-signed yet
 6. Batch hashes and signatures  NOT CHECKED  0 batches; nothing co-signed yet
 7. Batch chain                  NOT CHECKED  0 batches; nothing co-signed yet
 8. Signed heads                 NOT CHECKED  0 heads; nothing co-signed yet
 9. drand rounds                 NOT CHECKED  0 rounds
10. Anchors                      NOT CHECKED  0 anchors; local state holds no anchors
11. OpenTimestamps               NOT CHECKED  0 proofs
12. Content hashes               PASS         5 records
coverage: _pending/nokey/support-bot: all 2 declared tools are recorded
checked here: signatures, chain links and content hashes of all 5 records, using this machine's keys
co-signature, public timestamp: not yet. Run `signafaide init` to send hashes, or self-host (SIGNAFAIDE_URL)
PASS: 4 of 12 checks passed, 8 not checked (nothing co-signed yet)

What is recorded and what is not #

• Recorded. Every call of a wrapped function tool that the runner makes: the tool name and input, then the output or the error. Inputs and outputs stay in .signafaide/ on your machine. Nothing is sent until you run signafaide init, and then only salted hashes.
• Not recorded. Hosted tools, such as web search, run outside your process and cannot be wrapped: wrap_tools refuses them. A tool you did not wrap leaves no record either. Give the full list to declare_tools or declareTools and signafaide verify names the tools that are not recorded.
• Evidence, not certification. Records prove integrity and timing, not that a decision was right. The eight checks not run above need a witness: the co-signature and the public timestamp come after signafaide init.

Next: install, wrap, verify and send hashes, step by step. OpenAI Agents SDK quickstart