chore: adopt receipts — zero-install agent-work verification

.claude/.gitignore

@@ -0,0 +1,3 @@
+*
+!settings.json
+!.gitignore

.claude/settings.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y altimate-receipts@latest hook pre-push"
+          }
+        ]
+      }
+    ]
+  }
+}

.codex/hooks.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y altimate-receipts@latest hook pre-push --agent codex"
+          }
+        ]
+      }
+    ]
+  }
+}

.github/workflows/receipts.yml

@@ -0,0 +1,26 @@
+name: Verified by Receipts
+
+# Deterministic "what did the coding agent actually do?" check on PRs. Quiet + non-blocking
+# pilot: acts only when a branch commits an agent Receipt (.receipts/<branch>.json);
+# otherwise silent. Adds a new "Receipts" check only — touches no existing workflow.
+# Docs: https://github.com/AltimateAI/altimate-receipts/blob/main/docs/onboarding-internal.md
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  id-token: write # Sigstore keyless signing of the receipt
+  attestations: write # record the attestation
+  pull-requests: write # post the Receipts comment
+  checks: write # post the Receipts check
+
+jobs:
+  receipts:
+    # Tracks the v0 major tag (auto-gets minor/patch features). Pin a full version
+    # (e.g. @v0.6.1) or a commit SHA for immutability.
+    uses: AltimateAI/altimate-receipts/.github/workflows/receipts.reusable.yml@v0
+    with:
+      require-receipt: false # never fail a PR that has no receipt (soft pilot)
+      notify-when-missing: false # stay silent unless a receipt is present
+      # block-on: ""          # informational check; never blocks a merge