Feature: attach a signed, recomputable receipt to AI agent decisions that use gs-quant computations

gs-quant is used for risk calculations, derivatives pricing, and portfolio analytics. When an AI agent calls gs-quant functions to drive automated trading or risk decisions, the downstream compliance question is: which computation ran, with which inputs, and what did it produce?

MiFID II RTS 6 requires firms to document algorithmic trading decisions with enough detail to reconstruct the decision chain. EU AI Act Article 12 adds logging obligations for high-risk AI systems making automated decisions with legal or significant financial effects. The current pattern for AI agents using gs-quant produces agent-framework logs that are framework-specific and not independently checkable outside that session.

The vaara.receipt evidenceRef pattern addresses this. The agent records the gs-quant computation as an evidence object:

{
  "function": "calc_delta",
  "inputs": { "underlier": "AAPL", "expiry": "2026-09-19", "strike": 195.0 },
  "output": { "delta": 0.62 }
}

evidenceRef.digest is sha256(JCS(evidence_object)): SHA-256 over the JCS-canonical bytes (RFC 8785). The digest is controller-signed and goes into the receipt envelope, specified in draft-sirkkavaara-vaara-receipt-01. Any auditor can recompute the digest from the evidence object alone without access to the signing key.

The receipt links the automated decision to the specific gs-quant computation that supported it, with a signature that cannot be altered after the fact.

Conformance corpus and stdlib-only checker at github.com/vaaraio/vaara (conformance/sep2828/fallback_projection_v0/).