feat: add nobulex — Ed25519 receipt layer for Dify agents (EU AI Act Article 12)

[arian-gogani]

1. Metadata

• Plugin Author: arian-gogani
• Plugin Name: nobulex
• Repository URL: https://github.com/arian-gogani/nobulex

2. Submission Type

• New plugin submission

3. Description

Nobulex adds a cryptographic receipt layer to any Dify agent workflow. Every tool call gets an Ed25519-signed, JCS-canonical receipt, hash-chained to the previous one. Change any byte and verification fails at that point. An auditor verifies the complete history offline with only the agent's public key — no vendor dependency.

Four tools:

• sign_receipt — sign a receipt for one tool call (action_type + scope + optional policy_version)
• verify_receipt — verify a receipt's signature and chain integrity offline
• export_article12 — export a regulator-facing EU AI Act Article 12 evidence package
• get_trust_score — get the agent's Trust Capital score (0-100) based on verified receipt history

EU AI Act Article 12 enforcement begins August 2, 2026. Dify enterprise users deploying agents in regulated industries (finance, healthcare, legal) need tamper-evident per-action evidence — not just platform logs. This plugin produces independently verifiable receipts in a standard format.

Built on pip install nobulex (PyPI, cross-validated against 4 published bilateral receipt test vectors). Sections 8-11 of the OWASP AML and Sanctions Compliance for AI Agent Payments cheat sheet (PR #2210, merged June 2026) include this receipt format's JCS canonicalization rationale and EU AI Act compliance mapping.

4. Checklist

• I have read and followed the Publish to Dify Marketplace guidelines
• I have read and comply with the Plugin Developer Agreement
• I confirm my plugin works properly on both Dify Community Edition and Cloud Version
• I confirm my plugin has been thoroughly tested for completeness and functionality
• My plugin brings new value to Dify

5. Documentation Checklist

• Step-by-step setup instructions
• Detailed usage instructions
• All required APIs and credentials are clearly listed
• Connection requirements and configuration details
• Link to the repository for the plugin source code

6. Privacy Protection Information

Data Collection: The plugin does not collect any user personal data. All cryptographic operations run locally in the Dify environment.

• I confirm that I have prepared and included a privacy policy in my plugin package based on the Plugin Privacy Protection Guidelines

[crazywoola]

❌ Request Changes

Decision: Request changes

Failed Checks

Check	Status	Detail	Required action
Icon validation	❌ Fail	icon file not found: _assets/_assets/icon.svg	Provide a real custom icon file under _assets/ and reference it from manifest.yaml.
dify_plugin version	❌ Fail	dify_plugin must be installed and >= 0.9.0, but it was not found.	Use dify_plugin >= 0.9.0 in the packaged plugin environment.
Install test	❌ Fail	Command failed (1): /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/.venv/bin/python /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/toolkit/validator/test-plugin-install.py -d /var/folders/vc/vfsgl8611qn5…	Fix the plugin so test-plugin-install.py passes.
Packaging test	❌ Fail	Command failed (1): /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/.venv/bin/python /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/toolkit/uploader/upload-package.py -d /var/folders/vc/vfsgl8611qn508whms…	Fix the plugin so upload-package.py --test passes.

Full Check Results

Check	Status	Detail	Required action
PR content language	✅ Pass	PR title/body CJK ratio=0.0% (zh=0, en=2002, ignored_zh=0, allowed_zh<=0)	None.
Project structure	✅ Pass	All expected files present: manifest.yaml, README.md, PRIVACY.md. _assets/: yes.	None.
Manifest author	✅ Pass	author is valid.	None.
Icon validation	❌ Fail	icon file not found: _assets/_assets/icon.svg	Provide a real custom icon file under _assets/ and reference it from manifest.yaml.
Version check	✅ Pass	version 0.0.1 is available.	None.
README language	✅ Pass	README.md CJK ratio=0.0% (zh=0, en=1799, allowed_zh<=0)	None.
PRIVACY.md	✅ Pass	PRIVACY.md exists and is non-empty.	None.
Dependency install	✅ Pass	requirements installed successfully.	None.
dify_plugin version	❌ Fail	dify_plugin must be installed and >= 0.9.0, but it was not found.	Use dify_plugin >= 0.9.0 in the packaged plugin environment.
Install test	❌ Fail	Command failed (1): /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/.venv/bin/python /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/toolkit/validator/test-plugin-install.py -d /var/folders/vc/vfsgl8611qn5…	Fix the plugin so test-plugin-install.py passes.
Packaging test	❌ Fail	Command failed (1): /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/.venv/bin/python /var/folders/vc/vfsgl8611qn508whmstl644w0000gn/T/pr-review-helper-xqnxrfc8/toolkit/uploader/upload-package.py -d /var/folders/vc/vfsgl8611qn508whms…	Fix the plugin so upload-package.py --test passes.

Next steps

• Icon validation: Provide a real custom icon file under _assets/ and reference it from manifest.yaml.
• dify_plugin version: Use dify_plugin >= 0.9.0 in the packaged plugin environment.
• Install test: Fix the plugin so test-plugin-install.py passes.
• Packaging test: Fix the plugin so upload-package.py --test passes.

Please address these issues and push an update.