Prompt purchase receipt verifier should run without hosted app dependencies

[prissca]

Problem

Buyers and reviewers need an independent way to verify prompt purchase receipts, metadata hashes, and transaction references.

Scope

• Create standalone receipt verification CLI or page
• Verify prompt ID, version, buyer, tx hash, and contract ID
• Add tamper tests

Acceptance criteria

• Receipt verification works from exported receipt data
• Tampered receipt fields fail verification
• Docs explain verification steps

Relevant areas

• src
• api
• docs/integration-guide.md

Complexity

High - 200 points

Contributor guidance

Start with a short design note in the issue discussion, then implement with focused tests and documentation for the affected workflow.

[safal207]

A verifier is only independent if it does not trust fields merely because they appear together in the exported receipt.

I’d define a versioned receipt containing the Stellar network, contract ID, transaction hash, buyer, prompt ID/version, and metadata hash. The verifier would resolve the transaction directly from Stellar, locate the expected contract invocation or event, and compare every receipt field against that on-chain evidence using canonical byte encoding. The hosted Prompt Hash API would not participate in the trust path.

Tamper tests should modify each field independently, reuse a valid transaction from another contract or network, and supply a real transaction that lacks the expected purchase event. I’d also return stable machine-readable failure codes so reviewers can use the verifier in CI instead of interpreting text output.

My previous work on canonical Stellar/XDR commitments and domain-separated hashes is in Bitcoindefi/Stellar-Game-Studio#14; replay-safe request identity and conflict handling is in TrustLayer-Org/TrustLayer-Backend#12.

[ZacLou]

I'd like to work on this issue. I'll review the requirements and open a PR shortly.

[Ranjeet2063]

Hey team, I would love to tackle this issue!

Execution Plan for Prompt purchase receipt verifier should run without hosted app dependencies:

• Clean Implementation: Deliver an idiomatic solution for Prompt purchase receipt verifier should run without hosted app dependencies adhering strictly to Prompt-Hash-Stellar/prompt-hash's architecture.
• Automated Tests: Provide full test coverage asserting both edge cases and core workflows.
• Clean Git Hygiene: Atomic conventional commits with zero merge conflicts.

Why assign me?

• Proven Proof-of-Work: ci(deps): bump actions/upload-artifact from 3 to 7 #1 contributor on Mova Store (28 merged Web3 PRs) and official ElizaOS contributor.
• Fast Turnaround: Dedicated to shipping a tested, production-grade PR within 12–24 hours.
• Zero Maintainer Burden: Self-documenting code with green CI and tests included so you don't spend time debugging.

Ready to deliver within 12–24h—please feel free to assign it to me!

[shobhamerabacha-star]

Hello! I'd like to work on this issue.

I would like to resolve this issue. Here is my proposed execution plan:

• Implementation: Deliver a clean, modular solution for Prompt purchase receipt verifier should run without hosted app dependencies strictly following Prompt-Hash-Stellar/prompt-hash conventions.
• Testing & Verification: Cover changes with automated tests ensuring CI passes smoothly.
• Delivery: Ready to ship a thoroughly tested PR within 12–24 hours with passing CI.

Looking forward to contributing—please feel free to assign!