#29895 [FEAT] Post-call receipt middleware for tamper-evident audit trails — EU AI Act Article 12
## Problem
LiteLLM routes LLM API calls across providers with a unified interface. For enterprise deployments in regulated industries, the call logs that LiteLLM produces are operator-controlled — they can't be independently verified by an auditor who doesn't trust the operator's infrastructure.
EU AI Act Article 12 (enforcement August 2, 2026) requires tamper-evident automatic logging for high-risk AI systems. 'Tamper-evident' implies independent verification — not just structured logging.
## Proposed: Post-call receipt hook
LiteLLM's callback system (`success_callback`, `failure_callback`) is the right integration point. A receipt callback that generates an Ed25519-signed, hash-chained record after each LLM call:
```python from litellm import completion import litellm from nobulex import Agent as NobulexAgent
nobulex = NobulexAgent('litellm-gateway')
def on_success(kwargs, completion_response, start_time, end_time): receipt = nobulex.sign_receipt( action_type=kwargs.get('model', 'unknown'), scope=str(kwargs.get('messages', [{}])[0].get('content', ''))[:200] ) # Ed25519 signed, hash-chained # Any auditor with the public key can verify offline…