Audit/update 2026-04-25:

• No branch mutation in this audit.
• Focused local validation: 20 passed in 0.99s (tests/test_execution_receipts_impl.py).
• Recommendation: Execution receipts CLI layer; stacked on feat(tools): add execution receipts core engine + tool wrapper #14836/feat(tools): integrate execution receipts into delegate_tool #14837, so review after the bases.

This was part of the open-PR cleanup pass against current upstream/main.

Refreshed this PR onto current main and the execution-receipts core branch, then re-applied only the /receipts CLI integration on top.

Validation run locally:

• python3 -m py_compile cli.py hermes_cli/commands.py hermes_cli/receipts.py tools/execution_receipts.py tools/execution_receipts_tool.py
• /receipts smoke check via resolve_command, COMMANDS, SUBCOMMANDS, handle_receipts_command('status'), and handle_receipts_command('list --limit 1')
• ./scripts/run_tests.sh tests/test_execution_receipts_impl.py tests/tools/test_registry.py tests/hermes_cli/test_commands.py -q → 183 passed
• Targeted check for CI-only PR-delta-looking failures also passed locally on both this branch and clean main.

Remote state after push:

• Head: 3d36f045016a8225ca1098fb5711c5675ab87d3c
• GitHub reports MERGEABLE.
• Passing checks: attribution, lockfile check, supply-chain audit, e2e, Nix macOS.
• Failing checks appear baseline/unrelated: current main at 42b917c92ce8a1e306bdbcaf04029e8f80ceba83 is also red for both Tests and Nix; the Nix Ubuntu failure is the same npmDepsHash is out of date / package-lock.json mismatch.

I kept the remediation scoped to the receipts CLI surface and did not fold in unrelated fixes for the current main CI noise.

Closing this for now to reduce stale review surface. The execution-receipts stack has drifted from current main, and this top PR now conflicts in cli.py / hermes_cli/commands.py. If the feature is still needed, rebuilding it as a fresh smaller slice would be cleaner.