AgentGuard workflows
Public tree verification
Share /verify/workflow/{id}. Anyone can replay the full chain, download the receipts, and check that every parent link is intact.
Receipt-chain rule
Every receipt stores the previous receipt hash. Resume is refused if any signature, parent receipt, or chain hash fails validation.