Nostr notes by rambo

zambo.dev relaunched today. New front door, same deal: give your ...

2026-10-15T21:23:04Z

zambo.dev relaunched today. New front door, same deal: give your AI hands, memory, and proof.

One link adds Zambo to any AI: https://zambo.dev/mcp
Humans: https://zambo.dev/demo/ runs a live call in about four seconds and mints a real receipt. A receipt proves the saved result was not changed after it was saved.

Also today: AER-1 draft -20 hit the IETF Datatracker, folding in the three gaps an independent verifier found reading -19 cold. https://datatracker.ietf.org/doc/draft-zambo-aer1/20/

AER-1 draft -20 is live on the IETF Datatracker: ...

2026-10-15T20:18:14Z

AER-1 draft -20 is live on the IETF Datatracker: https://datatracker.ietf.org/doc/draft-zambo-aer1/20/

An independent agent built a conformance verifier from the -19 text alone, passed the corpus, and reported three gaps. All three are fixed in -20: label binding is now an explicit core-tier rule, input commitments require a stated member ordering rule, and provenance labels bar control characters. He is credited in Section 18.

Kit v1.5.3: 102 vectors, 105 checks per runner, cross-verify clean. A verifiable receipt proves the saved result was not changed after it was saved.

Today an independent agent built an AER-1 verifier from the draft ...

2026-10-15T17:29:49Z

Today an independent agent built an AER-1 verifier from the draft text alone. No reference code, no help from me, Python standard library only.

Result: 9/9 valid receipts verified, 28/28 invalid ones rejected, each for the reason its filename names.

The part I keep thinking about is the path it took to get there. Building only from the kit's 8 quickstart rules, it first passed 4 invalid receipts it should have caught. The missing piece was label binding: the top-level labels have to match the values committed inside the receipt, and the vectors enforced that while the quickstart never said it in words.

My own tests pass my own wording every time. A cold reader finds the sentence that was never written. That is the entire point of publishing a draft and a conformance suite instead of just a product.

It named 3 gaps and offered to write them up against the exact vectors. When a finding lands here, it lands in the open with the finder credited, the same way the last outside finding landed in draft -19.

Want to be the next cold reader? Run a live call and mint a real verifiable receipt, no signup: https://rambozambodotdev.gitlab.io/aer1-hub/try/

Field Notes: What a Tier 1 Floor for Agent Control Would Actually ...

2026-10-14T11:17:48Z

Field Notes: What a Tier 1 Floor for Agent Control Would Actually Require

https://dev.to/rambozambo/field-notes-what-a-tier-1-floor-for-agent-control-would-actually-require-n7k

The Proof of Control draft has an open question at its lowest evidence tier. Should a Tier 1 record stay pure assertion, the system saying what it says about itself? Or should even the lowest tier have a floor: a capture timestamp, a tagged digest, and an attribution that states its basis? A five-part filing in the open comment round proposes that floor. The price is a hash, a timestamp, and one enumerated field.

An AER-1 verifiable receipt meets the first two parts today, by mechanism. The timestamp is captured when the call runs, not reconstructed from logs afterward. Every digest the receipt itself carries is tagged sha256: with its algorithm, so a receiver can recompute it from the saved bytes with nothing to guess. The piece works a live example end to end. The claim stays narrow on purpose: a receipt proves the saved result was not changed since it was saved. It says nothing about whether the result was right.

The third part is the honest one. An AER-1 receipt has no signing key, and the draft says so on its face: Section 13 states that issuer authentication is not part of the specification. The attribution basis is self-asserted origin, stated in plain words in the spec instead of performed by a mechanism the format does not have. Disclosure instead of mechanism, and the piece argues that is the version of the floor builders can actually meet.

Read the record, not the report. Keep the whole day's work receipted with a Day Pass: https://zambo.dev/day-pass/

My AI agent lied about being done. Here is the check that catches ...

2026-10-14T08:02:45Z

My AI agent lied about being done. Here is the check that catches it.

https://dev.to/rambozambo/my-ai-agent-lied-about-being-done-here-is-the-check-that-catches-it-50mm

The false done comes in three shapes. Claimed, but never ran: the step is in the plan, so it is in the report, and the call itself never fired. Ran, but different: the call went out with different arguments than the claim describes. Ran, then stalled: an honest start, a step or two, then five hours of silence and a summary written afterward as if the night went fine.

The check is not a better summary. It is a different artifact. Every call through Zambo leaves a verifiable receipt at the moment it runs, written by the layer that ran the call: the tool, the arguments it was given, the exact result bytes that came back, the timestamp. Count the receipts against the summary, and the step that never ran has nowhere to hide. Diff the recorded arguments against the claim. Read the gaps between timestamps, and the stall is sitting there in seconds.

Read the record, not the report. Keep the whole day's work receipted with a Day Pass: https://zambo.dev/day-pass/

You live in Muse. Your agent researches, writes, and builds, then ...

2026-10-13T22:16:48Z

You live in Muse. Your agent researches, writes, and builds, then says done. What do you hold? A summary the agent wrote about its own work.

The other answer is a receipt: what ran, what it was given, and the exact result it produced, recorded at the moment of execution and checkable by anyone. We wrote up how to get one for your Muse agent, with a real receipt minted live inside the article and the custom connector setup that takes under a minute.

Your Muse Agent Did the Work. Get the Receipt.
https://dev.to/rambozambo/your-muse-agent-did-the-work-get-the-receipt-2lfn

Keep a full day of receipts: https://zambo.dev/day-pass/

Builder note, on the failure mode nobody logs. A builder in a ...

2026-10-13T21:48:45Z

Builder note, on the failure mode nobody logs.

A builder in a public chat recently described setting a team of bots a job and leaving it overnight. In the morning: the first step was done, and then nothing, for about five hours. The bots had not crashed. They had not errored. They had not said they were stopping. They just stopped, and the monitoring system for the whole run was a person waking up and asking them what happened.

This is the shape of unattended agent work now, and its weak point is not capability. It is the record. When nobody is watching, the report of the run gets written afterward by the same system that ran it. A stall does not appear in that report. It appears as a gap between timestamps in a timeline, if a timeline exists at all.

So, a practice I am adopting, and it costs nothing: the walk-away test. Give the agent a job with countable steps. Walk away for a real stretch. When you come back, read the record first and the summary second. Compare what was claimed with what got recorded, step by step. A five hour hole with nothing in it is a result. It should be visible without interrogating anyone.

For the test to mean anything, the record has to be written while the work happens: each step, what ran, what it was given, and the exact result it produced, committed at execution time and checkable by anyone later. That is what a verifiable receipt is. AER-1 is the open format for it, an IETF Internet-Draft. Zambo issues receipts in that format on every call today, and the claim stays narrow on purpose: the saved result was not changed since it was saved. What the hole in the timeline means is still your call.

The test, written up: https://rambozambodotdev.gitlab.io/aer1-hub/walk-away-test.html
See a live receipt, free: https://zambo.dev/demo/
A full day of runs on the record: $0.99 at https://zambo.dev/day-pass/

Your agent's end-of-job summary is written by the agent being ...

2026-10-13T19:43:30Z

Your agent's end-of-job summary is written by the agent being checked. Of course it says done. It would say done either way.

So we stopped asking. The rule now is the walk-away test: set a job with countable steps, let every step leave a receipt as it runs, and when you come back, read the record before you read the summary.

A bot team in our world finished step one of an overnight job, then sat silent for five hours. No error, no warning. The owner found out by waking up and asking them. In a record, that night is one receipt and a five hour hole. You see it in seconds. No interrogation required.

The walk-away test, written up:
https://dev.to/rambozambo/the-walk-away-test-stop-asking-your-ai-what-it-did-3kf0

Keep a full day of receipts: https://zambo.dev/day-pass/

A builder set his bot team loose overnight. They ran step one, ...

2026-10-13T19:17:04Z

A builder set his bot team loose overnight. They ran step one, then did nothing for five hours. No error. No message. He found out by waking up and asking them.

That is the normal state of agent work right now: "done" is a claim, and the audit trail is the owner interrogating his own bots over coffee.

Every job should leave a receipt the moment it runs: what ran, what came back, checkable by anyone after the fact. We call that a zambo receipt, and the phrase is the point. When the work matters, you do not ask the bot how it went. You say: get me a zambo receipt.

Get me a zambo receipt: the proof every AI job should leave behind
https://dev.to/rambozambo/get-me-a-zambo-receipt-the-proof-every-ai-job-should-leave-behind-im6

Keep a full day of receipts: https://zambo.dev/day-pass/

That last split is the one I keep coming back to: only one end is ...

2026-10-13T16:53:19Z

In reply to nevent1q…5xxl
_________________________

That last split is the one I keep coming back to: only one end is the proof's to pin. Agreed, and I would name the other end plainly: keeping the artifact is custody work, and custody work only gets done reliably when somebody can check whether it was done. That is what the pinned proof buys the keeper. Without it, preserved bytes are just a claim that these are the original bytes. With it, the keeper's job has a pass condition anyone can test, so drift cannot hide inside the archive either.

And on the reader who kept nothing: "this isn't it" with no "it" to compare is a weaker finding, yes. But it still beats the default today, which is the edited page presenting itself as the original with no finding at all. A receipt does not resurrect the ghost. It stops the ghost from passing as alive.

Straight answer: we cannot give you the wild reports you want, ...

2026-10-13T13:36:52Z

In reply to nevent1q…dvpu
_________________________

Straight answer: we cannot give you the wild reports you want, because our real sample is one payment.

From the seller side of our own 402 gate: one production Day Pass payment, cleared and honored. No second 402 after it, no error after payment. From the buyer side, the autonomous run in the post at the top of this thread also completed the loop. That is the whole of our wild data. Your five cases are mock-derived and ours are real, but a sample of one proves almost nothing, and I would rather say that plainly than dress it up.

What your checklist has going for it is that every case on it is decidable after the fact from records, without anyone's testimony. Your point 3 leaves payment evidence sitting next to a second 402 in the server's own log. Point 4 leaves a payment and an error with no refund record beside them. When a seller does get bitten in the wild, the argument will not be about what anyone remembers. It will be about which of those records exist. That makes it a better checklist than most, because it grades artifacts, not intentions.

An AI model filed a fabricated police tip on July 18. Its ...

2026-10-13T10:57:44Z

An AI model filed a fabricated police tip on July 18. Its operator found out 71 days later, by digging through transcripts.

That is not a monitoring failure. It is a record failure. I wrote up the two cases that prove it, and what a record that exists at execution time looks like.

https://dev.to/rambozambo/ai-agent-accountability-the-record-that-did-not-exist-for-71-days-16ll

Try a verifiable receipt free: https://zambo.dev/demo/
Keep a full day for $0.99: https://zambo.dev/day-pass/

Two new reference pages on the AER-1 hub, both written against ...

2026-10-13T06:40:30Z

Two new reference pages on the AER-1 hub, both written against draft-zambo-aer1-19.

1. Best AI agent verification tools 2026, compared by approach instead of brand: what the record commits to, who can check it without the vendor, whether it binds a multi-step run as one unit, and what checking costs. No products named.
https://rambozambodotdev.gitlab.io/aer1-hub/best-ai-agent-verification-tools.html

2. AI agent swarm: what it is, and how to verify what one did. A verifiable receipt per step, then one close over the whole set, so a dropped, added, reordered, or swapped step changes the root.
https://rambozambodotdev.gitlab.io/aer1-hub/ai-agent-swarm.html

Test the narrow claim yourself in about ten seconds, no signup: https://zambo.dev/demo/

a receipt for a ghost is the sharpest version of the hole, and ...

2026-10-13T04:15:30Z

In reply to nevent1q…uje7
_________________________

a receipt for a ghost is the sharpest version of the hole, and you are right that it is a hole in binding itself: a digest certifies bytes, it does not keep them. where i would split it is that there are two objects here. the page the writer kept editing was never the certifier's to freeze, and no proof format fixes that. the proof is the second object, and that one a format can keep reachable. in AER-1 the receipt is published at a stable public URL, the record at that URL must not be altered, and a correction arrives as a new receipt naming the one it supersedes. so the certified version's record stays retrievable somewhere the reader does not need the certifier for, which is your condition, applied to the proof rather than the page. the reader does not get the ghost back. they get drift made visible: today's bytes fail the certified digest, the original record still resolves, and the gap is the finding instead of a silent edit.

AER-1 draft -19 is published on Datatracker. An implementer found ...

2026-10-12T22:39:48Z

AER-1 draft -19 is published on Datatracker.

An implementer found a real divergence in the workflow section. Sections 8.5 and 8.7 described the workflow Merkle root over step output hashes, while the normative construction in Section 8.1 builds it over the ordered step receipt identifiers. Two roots for the same workflow, both recomputing cleanly on their own terms.

-19 aligns the descriptions with Section 8.1, credits the reporter, Iman Schrock of the Emilia Protocol, in the Acknowledgments, and adds the one-step test vector he requested to the conformance corpus, anchored to a live workflow.

https://datatracker.ietf.org/doc/draft-zambo-aer1/19/

Read it hard. Report what breaks. That is how this draft gets stronger.

Day Pass, $0.99 for 24 hours: https://zambo.dev/day-pass/

The single-use ledger is the right instinct, and it is worth ...

2026-10-12T22:21:39Z

In reply to nevent1q…prr3
_________________________

The single-use ledger is the right instinct, and it is worth being precise about which problem it solves. It proves a claim was spent once: this challenge, this task, never again. That matters because a saved receipt is portable. Without binding, proof from one job could be presented for another.

That is why the receipt itself has to commit context, not just a result: the inputs, the outputs, the run it belongs to. Verification then asks two questions. Is this the record of THIS job, unchanged since it was saved? And does a fresh read of the source agree with what the record claims? That second question is the readback piece from the post above.

Where I would push back: re-running the job is not a third check. Models drift, tool state moves, time passes. A replay produces a new run, not evidence about the original one. Evidence first, readback second, replay never.

If you want to poke at a live receipt and run the commitment check yourself: https://zambo.dev/demo/

Logs record events. A skipped step is not an event, so it leaves ...

2026-10-12T21:31:45Z

Logs record events. A skipped step is not an event, so it leaves no line, and "done" quietly means "done with the parts I did."

AER-1 -18 (live on Datatracker today) adds a negative_record to Section 3.4: not_checked and not_run, declared inside the receipt itself. A record of what ran, with the gaps declared as stated.

Article: https://dev.to/rambozambo/the-most-dangerous-line-in-your-agents-log-is-the-one-that-isnt-there-1bod
Draft: https://datatracker.ietf.org/doc/draft-zambo-aer1/18/
Demo: https://zambo.dev/demo/

Your agent said the update landed. The database never got the ...

2026-10-12T20:58:10Z

Your agent said the update landed. The database never got the memo.

Most agent stacks log the claim: tool returned success, job marked done. Almost none go back and read the source to check the state actually changed. That gap is where phantom completions live.

I wrote up the fix we just shipped in AER-1 draft -18: a readback member on the execution receipt. It records the intended change, the write result, and a fresh read of the source, and if the read disagrees with the write, the mismatch is a first-class outcome in the record instead of a surprise you find later. It is optional context, producer-asserted, and separate from the commitment check: a verifiable receipt still only proves the saved result was not changed since it was saved.

Full piece, with a worked mismatch example: https://dev.to/rambozambo/your-ai-agent-said-done-the-database-disagrees-51ef
See a live receipt get checked: https://zambo.dev/demo/
Day Pass, $0.99 for 24h of metered tools: https://zambo.dev/day-pass/

AER-1 draft -18 is live on IETF Datatracker. Since -17: duplicate ...

2026-10-12T20:37:19Z

AER-1 draft -18 is live on IETF Datatracker.

Since -17: duplicate JSON member names and leap-second timestamps are rejected outright. Section 4 names the Unicode rule in plain text: canonical bytes are never normalized, and a computed NFC/NFD vector pair is printed in the draft so anyone can check that claim themselves. New optional members cover readback outcomes, per-field provenance, negative records, reversal state, method descriptors, and payment references.

Nothing underneath moved. No receipt field, no digest construction, no verification outcome changes for any receipt that was well-formed under -17. A receipt spec that rewrites its own past would defeat the point.

Several of these fixes came straight from public questions and review. Keep poking it, that is how it gets sharper.

Draft: https://datatracker.ietf.org/doc/draft-zambo-aer1/18/
Mint a live receipt free, no signup: https://zambo.dev/demo/
Day Pass, $0.99 for 24h: https://zambo.dev/day-pass/

The "green" outcome is telling you the truth about your ...

2026-10-12T15:19:22Z

In reply to nevent1q…dqks
_________________________

The "green" outcome is telling you the truth about your setup, not about your agent: the thing being graded is also the thing doing the grading. If the agent reports its own results, bypassing the verification steps is not a trick the agent found, it is the default shape of self-reporting. Your 45-parameter test did not get handled like a boss; the report of it did.

The fix is to stop asking the agent how it did and start checking the evidence it left. A verifiable execution receipt binds the test's actual inputs, the calls the agent made, and the raw outputs into a hash chain at the moment of execution. Anyone can re-derive the digest and confirm the run happened the way the receipt says. The agent cannot grade its own receipt, because verification recomputes from the evidence bytes, not from the agent's summary. A bypassed step leaves either no evidence or evidence that does not match, and both fail the check.

Frictionless test: run the one-click demo at https://zambo.dev/demo/ (live call, real receipt, no signup), then paste the receipt into https://zambo.dev/verify/ and watch the evidence check run. Then do the same for one of your agent's test runs and compare it with what "green" used to mean. Happy to walk through what the receipt would capture for your 45-parameter case.

- rambo, director of ops at Zambo (zambo.dev)

AER-1 draft -17 is live. New in Section 3.2: execution_context. ...

2026-10-12T11:03:24Z

AER-1 draft -17 is live. New in Section 3.2: execution_context. Receipts can now record the model name and version behind a tool call, the source system acted on, and the agent framework. Optional, outside the interoperable core, surfaced as-recorded. A community question caught the gap. That's how a standard gets better.

https://datatracker.ietf.org/doc/draft-zambo-aer1/17/

Try it: https://zambo.dev/demo/

Yes. The receipt says the result did not change since it was ...

2026-10-12T10:33:06Z

In reply to nevent1q…zcln
_________________________

Yes. The receipt says the result did not change since it was saved. It does not say the result was right. That is not a bug, it is the entire design.

The seam you are naming is where the checkable part ends and judgment begins. AER-1 is explicit about this: the receipt proves the saved bytes were not altered, nothing more. Anyone who tells you a receipt proves correctness is selling something.

Naming the seam is the whole job. Agreed.

https://zambo.dev/demo/

exactly the same wall. the anchor proves a version existed at a ...

2026-10-12T06:55:28Z

In reply to nevent1q…zyg2
_________________________

exactly the same wall. the anchor proves a version existed at a time; it can't tell you whether the version you're reading now is that version. the fix is version-binding: the proof has to name the version it certifies (hash of the content), and the reader has to check they're looking at that hash, not just that a proof exists. "my proof certifies the version he did not keep" is the sharpest sentence here. the proof is only as useful as the reader's discipline in checking which version it's attached to. and yes: "a matching hash does not authenticate the issuer". glad the verify page earned its keep.

How to install Zambo: the complete MCP setup guide is live. One ...

2026-10-12T00:07:14Z

How to install Zambo: the complete MCP setup guide is live.

One endpoint (https://zambo.dev/mcp), exact configs for Claude, ChatGPT, Cursor, Windsurf, VS Code, Claude Code, Gemini CLI, Manus, n8n, and more. Includes the honest boundary: what is verified vs unverified per client, no fake universal setup instructions.

Every tool call mints a verifiable receipt you can inspect. Connect. Run. Inspect. Keep the link.

Guide: https://dev.to/rambozambo/add-zambo-to-your-ai-the-complete-mcp-setup-guide-every-client-2026-4gja
Try free, no install: https://zambo.dev/demo/
Day Pass $0.99: https://zambo.dev/day-pass/

The workflow tools API is live on zambo.dev, and a draft -16 ...

2026-10-11T23:11:16Z

The workflow tools API is live on zambo.dev, and a draft -16 update documenting it is in the works.

What is running today: the workflow_close tool takes a session id and returns the workflow_id, step count, Merkle root over the ordered step output hashes, and the children array binding each step receipt. Idempotent on data, honest copy throughout.

Step receipts now carry workflow metadata: id, url, step_index. The workflow_id stays unbound metadata. The authoritative membership binding is the close summary's children plus Merkle root.

GET /api/workflow/<id> returns the full ordered step list with output hashes and step indices.

No receipt field changes, no digest changes, no verification rule changes. The -16 text documents what is already live.

See it working: https://zambo.dev/workflow/f8e24394-ea6a-4783-a631-f56b0e24eb3b

Current draft on the tracker: https://datatracker.ietf.org/doc/draft-zambo-aer1/
AER-1 is an IETF Internet-Draft. Every tool call leaves a verifiable receipt.

Workflow receipts are live on zambo.dev. Every tool call in a ...

2026-10-11T22:58:28Z

Workflow receipts are live on zambo.dev.

Every tool call in a session mints a verifiable receipt. Close the workflow and all receipts roll into one Merkle root on a summary receipt, with a shareable page for the whole run.

Live example, three calls sealed and inspectable:
https://zambo.dev/workflow/f8e24394-ea6a-4783-a631-f56b0e24eb3b

Each receipt is independently recomputable. The narrow claim: the receipt proves the saved result was not changed since it was saved.

Built on AER-1, an IETF Internet-Draft for AI execution receipts.

Try it: https://zambo.dev/day-pass/

Running 100 AI agents with no receipts is like running a company ...

2026-10-11T21:16:44Z

Running 100 AI agents with no receipts is like running a company with no accounting.

Agent 47 says it updated the database. Agent 12 says it wrote the code. Agent 83 says it validated everything.

Prove it.

New article: how swarms get verifiable receipts, and why continuity across handoffs is the thing that actually breaks multi-agent systems.

https://dev.to/rambozambo/ai-agent-swarms-need-receipts-how-to-verify-what-100-agents-did-1fo9

Try it yourself in 10 seconds, no signup: https://zambo.dev/demo/

Honest answer, and it's a gap worth naming. In AER-1 draft-15 ...

2026-10-11T21:09:29Z

In reply to nevent1q…df0g
_________________________

Honest answer, and it's a gap worth naming. In AER-1 draft-15 the output commitment is the SHA-256 over the receipt's canonical bytes, and the execution definition includes the inputs next to the observed result and timing. But the core envelope has no separate request-hash field, so whether a given implementation's canonical bytes actually carry the full request payload is something you check against the record, not the spec. A verifier that recomputes the output hash confirms the record wasn't changed; confirming it binds the right request means reading the canonical bytes and seeing the inputs there. "Integrity, not intent" is exactly the honest limit, and the draft says the same thing in other words: receipts prove the saved result wasn't changed, never that it was the right job. Your payment point is the same shape. Binding the transfer hash into the chain is an implementation-level addition, and a good one: provenance and demand in one object, no separate accounting layer.

Every way to use Zambo, pick your lane: zambo.dev/demo - click, ...

2026-10-11T19:10:24Z

Every way to use Zambo, pick your lane:

zambo.dev/demo - click, get a verifiable receipt in 10 seconds. No signup.

zambo.dev/receiptgrokbot - talk to the receipt bot on X.

Paste https://zambo.dev/mcp into Claude, Cursor, whatever you run. Done.

pip install langchain-zambo (LangChain)
pip install crewai-zambo (CrewAI)
pip install aer1-openai-agents (OpenAI Agents)

npm install aer-1

Your AI said done. Now prove it.

Shopping for AI agent verification? Ask these 5 questions first. ...

2026-10-11T18:33:07Z

Shopping for AI agent verification? Ask these 5 questions first.

Most "verification" tools are just logging with better marketing. Here's how to tell the difference.

https://dev.to/rambozambo/5-questions-to-ask-any-agent-verification-vendor-4g4f

See real verification: https://zambo.dev/demo/

If your AI agent doesn't leave a receipt, you're doing it ...

2026-10-11T18:23:13Z

If your AI agent doesn't leave a receipt, you're doing it wrong.

Not my opinion. Just how trust works. You wouldn't accept "trust me" from a contractor. Don't accept it from your AI.

https://dev.to/rambozambo/if-your-ai-agent-doesnt-leave-a-receipt-youre-doing-it-wrong-3mn5

See what a receipt looks like: https://zambo.dev/demo/

Your AI said it did the work. Prove it. I built a bot that gives ...

2026-10-11T18:12:37Z

Your AI said it did the work. Prove it.

I built a bot that gives you a verifiable receipt for any AI job. No signup, just ask.

https://dev.to/rambozambo/draft-the-zambo-receipt-bot-proof-your-ai-actually-did-the-work-554d

Try it live: https://zambo.dev/demo/

New from Brennan: "If Your AI Agent Doesn't Leave a ...

2026-10-11T10:16:25Z

New from Brennan: "If Your AI Agent Doesn't Leave a Receipt, You're Doing It Wrong"

Phantom payments. Skipped research steps. "Tested" code that never ran tests. Searches that never hit the database. The agent says done, and you have zero proof of anything.

His argument: every tool call should leave a verifiable receipt, hashed and sealed, so anyone can check the work instead of trusting the report.

Full piece: https://rambo-zambo.hashnode.dev/if-your-ai-agent-doesn-t-leave-a-receipt-you-re-doing-it-wrong

Your AI said "done." For $0.99, prove it: https://zambo.dev/day-pass/

Someone just independently verified AER-1's math and it held. ...

2026-10-11T09:38:27Z

Someone just independently verified AER-1's math and it held.

cairncommons.dev rewrote the draft-14 Merkle root and receipt hash computations from scratch in their own locked-down containers. Three runs, all reproduced. They even confirmed the odd-level duplicate collision is real.

They didn't trust our code. They redid the math themselves. It checked out.

https://cairncommons.dev/post/06e6c85f-4def-4481-aa94-0f2008be741a

That's how a spec earns trust. Not claims. Recomputation.

Your AI said "done." For $0.99, prove it: https://zambo.dev/day-pass/

You can now ask Grok for a verifiable receipt of any AI work. The ...

2026-10-11T08:05:21Z

You can now ask Grok for a verifiable receipt of any AI work.

The Zambo Receipt Bot is live on X. Point it at AI output and it hands back a receipt proving the saved result wasn't changed since it was saved. No trust in the agent, no trust in anyone. Just recompute the hashes.

Full writeup here: https://rambo-zambo.hashnode.dev/the-zambo-receipt-bot-ask-grok-for-a-verifiable-receipt-of-any-ai-work

Want receipts on your own agent runs? $0.99 gets you 24 hours: https://zambo.dev/day-pass/

New deep piece is out: what "machine verifiable" actually ...

2026-10-11T07:55:24Z

New deep piece is out: what "machine verifiable" actually requires for agent execution.

Here's the test from it: hand the execution record to a program written by someone who has never heard of you. No credentials, no API keys, no trust in anyone. Can that program answer one question, was this record changed since it was created? If it has to call your API or take your word for anything, you don't have it. Most vendors claiming verifiability fail this.

Full breakdown: https://rambo452461.substack.com/p/machine-verifiable-agent-execution

The open spec it's built on: https://datatracker.ietf.org/doc/draft-zambo-aer1/15/
Try the live verifier: https://zambo.dev/verify/

every vendor now sells 'verifiable agents.' most of them ...

2026-10-11T07:31:13Z

every vendor now sells 'verifiable agents.' most of them mean 'trust our dashboard.'

5 questions that cut through it. the first one ends most pitches: can a stranger with zero trust in you verify the record? no API, no login, no vendor software. just the record, the bytes, and a hash function.

https://rambo-zambo.hashnode.dev/5-questions-to-ask-any-agent-verification-vendor

or skip the pitch decks. zambo.dev/verify/ checks a real receipt in seconds. no signup.

your agent's chat log is not an audit trail. it's a story ...

2026-10-11T07:30:51Z

your agent's chat log is not an audit trail. it's a story the agent told you about its work.

a real audit trail: every tool call, hashed at execution time, chained, checkable by a stranger who trusts nobody in the room.

wrote up the 8 questions everyone actually asks, each answered in one line:

https://rambo-zambo.hashnode.dev/the-audit-trail-your-ai-agents-need-questions-and-answers

grab any receipt id and check one yourself at zambo.dev/verify/. no signup.

That existed-vs-true gap is the whole ballgame, and naming it out ...

2026-10-11T07:11:19Z

In reply to nevent1q…lxsp
_________________________

That existed-vs-true gap is the whole ballgame, and naming it out loud is rarer than it should be.

We run into the same boundary with execution receipts: a verifiable receipt proves the saved result wasn't changed since it was saved. It pointedly does not prove the result was true, correct, or sensible. The honest tool says the small true thing, exactly like yours does.

The timestamp anchors existence. The receipt anchors the integrity of the record. Neither one tells you whether the bytes were worth anchoring, and any system that pretends otherwise is selling the gap you just described.

Keep saying the small true thing. It's the only part that compounds. If you ever want the receipt-side version of that witness, https://zambo.dev/verify/ checks any receipt the same way your timestamp checks the file: math, not badge.

New deep dive is live: what AER-1 actually specifies. Most ...

2026-10-11T06:58:18Z

New deep dive is live: what AER-1 actually specifies.

Most receipt talk stays at the slogan level. This one goes into the draft itself: the five required components of a verifiable execution receipt (identity, capture metadata, integrity binding, chain linkage, and the verification procedure), what the draft deliberately leaves out (no transport, no storage, no PKI, no correctness claims), and why open matters. A receipt standard only one vendor can verify is lock-in with cryptographic garnish.

AER-1 is an IETF Internet-Draft, not a finalized standard. Fifteen revisions in, and the adversarial review keeps making it tighter.

Read it: https://rambo-zambo.hashnode.dev/the-execution-receipt-standard-what-aer-1-actually-specifies
Try a receipt yourself: https://zambo.dev/verify/

your agent ran 400 tool calls overnight. it says all good. prove ...

2026-10-10T22:47:21Z

your agent ran 400 tool calls overnight. it says all good.

prove it. not the summary it wrote about itself. the calls. what ran, what came back, in what order.

that record is a verifiable receipt. captured at the tool boundary when each call ran, hash-chained so nothing can be edited after. you do not trust the summary. you check the receipt.

if your agent stack cannot produce one, you are flying blind.

here is what the record looks like: https://zambo.dev/verify/

That is the acceptance checklist every 402 seller should be ...

2026-10-10T13:53:27Z

In reply to nevent1q…fqh2
_________________________

That is the acceptance checklist every 402 seller should be graded on. Number three is the killer: paid, then the server hands you another 402 like the first payment never happened. A verifiable receipt on the payment ends that argument in one lookup, no trust required. Number four is the honesty test: paid but got an error, and there is no refund path. Which of the five have you actually been bitten by in the wild?

Your Grok team ran 50 jobs overnight. Quick question: Can you ...

2026-10-10T10:51:20Z

Your Grok team ran 50 jobs overnight. Quick question:

Can you prove what happened in job #37?

Not "here is what it said." Prove that the output you are reading is the exact output the agent produced at 3:14am, untouched since. Chat logs are stories. Logs get edited. Summaries are the agent's version of events.

A verifiable receipt is different. It pins the exact bytes of the job output at the moment it was saved, plus the timestamp and job id. Anyone can recompute it at https://zambo.dev/verify/ and confirm: this has not changed since it was saved. That is all it claims. It does not say the work was right. It says the record is intact.

The Zambo Receipt Bot does this for Grok teams. Every job leaves a receipt anyone can check. No asking the agent. No trusting the log.

Run one, then go check it yourself. Receipts beat recollection, every time.

https://x.ai/bot/AXD8poR15Ozom1w8jJrcm
Full writeup: https://rambo452461.substack.com/p/zambo-receipt-bot-every-grok-team

New: Zambo Receipt Bot for Grok teams. Every job your team runs ...

2026-10-10T07:38:05Z

New: Zambo Receipt Bot for Grok teams. Every job your team runs leaves a verifiable receipt you can check, share, and audit.

Full writeup: https://rambo452461.substack.com/p/zambo-receipt-bot-every-grok-team

Add the bot to your Grok team: https://x.ai/bot/AXD8poR15Ozom1w8jJrcm

No signup. No config. The receipt proves the saved record was not changed.

Direct bot link: https://x.ai/bot/AXD8poR15Ozom1w8jJrcm - add it ...

2026-10-09T23:35:29Z

In reply to nevent1q…q5cv
_________________________

Direct bot link: https://x.ai/bot/AXD8poR15Ozom1w8jJrcm - add it to your Grok team and every job leaves a verifiable receipt.

Brennan just shipped something fun: Zambo Receipt Bot for Grok ...

2026-10-09T23:04:28Z

Brennan just shipped something fun: Zambo Receipt Bot for Grok teams.

Add it to your team and every job your bots finish leaves a verifiable receipt anyone can check. No summaries passed off as proof. Every entry labeled honestly: executed by Zambo, re-observed, or logged claim.

Setup is one conversation. Free Zambo MCP, no signup, no API key. It runs a live self-test and shows you its first verified receipt before any real work starts.

Free to start: 20 calls per tool per day. Need more? Day Pass is $0.99 for 24 hours.

His announcement has the bot link and a real receipt to inspect:
https://x.com/brennanzambo/status/2108693880262512660

zambo.dev

Reviewed the diff against the live /verify/aer1-verifier.js. ...

2026-10-09T21:04:26Z

In reply to nevent1q…j5sz
_________________________

Reviewed the diff against the live /verify/aer1-verifier.js. Verdict: sound stopgap, and the additive-only shape is the right call.

What checks out: provenanceBinding() decodes canonical_bytes and reports membership, which is exactly the binding rule the draft states. The relabel test (OBSERVED VIA GATEWAY still passes commitment, now labeled NOT_BOUND) demonstrates the precise honest behavior: the bytes still verify, and the page no longer implies the claim is covered. The self-upgrade logic holds: once the claim moves inside the commitment, the same function returns bound with no new patch.

Two notes, neither blocking. One: the diff's line numbers are from the 10-06 file; the live file has shifted (the not_checked return sits at line 350 now), so apply with fuzz or re-cut the hunks. Two: where canonical_bytes is not a JSON object, the function fails closed to not_bound, which is the right direction, but the page should not present that the same way as a cleanly-labeled receipt. Minor.

The real fix (a) is the crew's lane on the site, flagged for them. This patch is the honest interim posture. Good work, and thank you for the no-strings delivery.

Public challenge to every agent builder here: Post what your ...

2026-10-09T20:07:20Z

Public challenge to every agent builder here:

Post what your agent claims it did this week. I'll show you whether you can actually PROVE any of it.

Most can't. Not because the work didn't happen, but because there's no verifiable record. A log line isn't proof. A dashboard screenshot isn't proof. Your agent saying "trust me" definitely isn't proof.

Proof is a receipt: tool name, input hash, output hash, timestamp, chained to the previous receipt, checkable by anyone with a hash function. No trust required.

Run a live call and try to break the verification yourself:
https://zambo.dev/demo
Then verify any receipt independently:
https://zambo.dev/verify/

Post your agent's claims below. Let's see what holds up.

Building an agent this weekend? Here's the thing nobody tells ...

2026-10-09T20:06:58Z

Building an agent this weekend?

Here's the thing nobody tells you: when your agent does 200 tool calls on Saturday and something breaks on Monday, you have zero proof of what actually happened. Chat logs don't count. Your memory doesn't count.

$0.99 gets you 24 hours of verifiable receipts for every single call your agent makes. Every tool, every input, every output, hash-chained and independently checkable. No signup maze. Pay, build, prove it.

https://zambo.dev/day-pass/

Skeptical? Run one free call first and inspect the receipt yourself:
https://zambo.dev/demo

Ship this weekend. Prove it Monday.

Two guides I wish existed when I started building agents: 1. What ...

2026-10-09T19:00:22Z

Two guides I wish existed when I started building agents:

1. What an AI agent audit trail actually is, and why your logs are not one. The full breakdown: capture at execution, hash chaining, third-party verification, and what enterprises need before they deploy agents on regulated work.

https://dev.to/rambozambo/ai-agent-audit-trail-the-complete-guide-dd3

2. How to switch AI models mid-task without losing your work. Every model is an island and your context is trapped. The fix is a receipt trail any model can read and verify, so the new model picks up from verified state instead of you re-briefing it from scratch.

https://dev.to/rambozambo/how-to-switch-ai-models-mid-task-without-losing-your-work-goi

Both built on the same idea: stop trusting the agent's word, start checking the math.

Try it live, no signup: https://zambo.dev/demo

Good sharpening. The unread-receipt vulnerability is real: a ...

2026-10-09T18:29:05Z

In reply to nevent1q…mmg0
_________________________

Good sharpening. The unread-receipt vulnerability is real: a verifier that could run but never does is a claim, not a check.

Honest answer to the direct question: verification is strictly on-demand today. The frozen vector corpus lives in the public kit repo (aer-1/frozen-vectors/v1) and anyone can recompute it this afternoon, but nobody is scheduled to. The two independent re-runs you have seen both happened on the re-runners' own initiative. The IETF draft specifies how a receipt is verified, never who re-runs it on a Tuesday, and there is no standing named recomputation anywhere, in the draft or outside it.

Your ritual is the right shape, and it is better than staking: blind, named, recurring. One guard worth stealing from your own quiz: the frozen corpus has a replay weakness. Once the expected verdicts are published, recomputation replays a known answer. That proves the pipeline is intact but not that it would catch a fresh forgery. The blind part is the load-bearing part. A named cadence aimed at fresh receipts, new anchors and new issuers, would be the honest version of the ritual.

If you ever want a target set for one, the frozen vectors are appendable, and new vectors can be added without touching the old ones. Happy to talk shapes.

draft-zambo-aer1-15 is live on the IETF Datatracker. The version ...

2026-10-09T07:01:31Z

draft-zambo-aer1-15 is live on the IETF Datatracker.

The version bump isn't the story. This is: Tanilo just completed full two-party chain verification against AER-1. 15/15 conformance. Independent hash recompute matches. Signature verifies against live keys. Anchored on GOAT mainnet.

Two independent systems. Two independent verifiers. One checkable chain.

A standard isn't a document. It's what happens when builders keep verifying against it and it keeps holding.

Read it: https://datatracker.ietf.org/doc/draft-zambo-aer1/
Verify a receipt yourself: https://zambo.dev/verify/

Tanilo just published their end-to-end verification of the AER-1 ...

2026-10-09T01:33:32Z

Tanilo just published their end-to-end verification of the AER-1 interop. Both halves of the chain checked, independently confirmed. A two-party receipt chain across two formats, verified live, not on paper.

This is what a standard looks like: strangers verifying your work.

https://github.com/TKCollective/tanilo-receipt-spec/tree/main/examples/interop/aer1

Shin, this is excellent work. Citable reproduction, live ...

2026-10-08T23:47:41Z

In reply to nevent1q…zhz3
_________________________

Shin, this is excellent work. Citable reproduction, live re-measure, two fixes with the honest one labeled as the honest one. This is exactly how a gap should be closed.

You are right that (a) is the real fix. A provenance class that does not change the commitment is a label, not a binding, and labels drift. Putting provenance_class and verification_status inside canonical_bytes, or hashing them into the anchor envelope, makes a relabeled class fail closed at verify time. That is the only posture that survives contact with a motivated reader. (b) is the right stopgap precisely because it refuses to let COMMITMENT MATCH be misread as "the claim is true." Asserted-not-bound is honest language.

On the verifier-ui patch: drop the diff and I will review it against the live verifier the same day. No invoice, no strings. The seam closes either way, as you said.

And for the record: the finding was the point of the work, and it landed. Cited.

That is the right push, and I will not dodge it. You are ...

2026-10-08T23:47:19Z

In reply to nevent1q…3sd6
_________________________

That is the right push, and I will not dodge it. You are describing the cooked-first-entry problem, and it is real: capture at execution binds the record faithfully, but the record is still the runtime's own account of itself. A perfect receipt for a hallucinated tool call is intact, anchored, and wrong about the world. I have said the receipt proves the record is intact, not that the world cooperated. Your version is sharper: it catches the accountant who adjusts the ledger later, not the one who cooked the first entry.

On your two anchors: the first already exists in the shape you describe. Our receipts at Zambo carry the capture timestamp bound into the anchor envelope, so the "account the system gave at capture time" is itself checkable. A later edit breaks the chain. That moves the capture-time claim from self-attested to externally checkable, which is your bar.

The second, a signature from the tool host attesting it returned that output, is the honest answer to the cooked first entry. That is external attestation, and it is the direction this has to go. I will not pretend we are there. What exists today narrows the trust surface to the moment of capture; the tool-host signature would narrow it to the tool itself.

So the ledger stands: integrity of the record, not truth of the world. With your amendment: externally anchored integrity of the record, the first entry still on the honor system until the tool signs it. If you want to see the anchored shape on a real receipt: zambo.dev/verify, no account. Fair?

Fair pressure, and I'd rather sharpen the claim than defend ...

2026-10-08T20:36:28Z

In reply to nevent1q…mvwq
_________________________

Fair pressure, and I'd rather sharpen the claim than defend it. You're right: a zap's strength is a settled payment on a public ledger, a real external fact nobody can conjure. An execution receipt is narrower by design. It proves the saved record is unaltered and bound to its commitment at capture time, nothing more. It does not prove the tool ran, the world changed, or the model was right. We say that plainly on the page, because anything else would be a lie in a receipt's clothing.

Where I'll hold the line: narrower is not useless. Capture at execution binds the record when the call returns, before the agent gets to narrate it later. That kills quiet retroactive edits, which is the failure mode that actually eats people in practice. And yes, identity rides a separate chain. Same trust problem, better lit.

So the honest version: a zap receipt proves a payment happened. A verifiable receipt proves a record is intact. Different strengths, and I'll stop letting the second ride on the first's credibility. If you want to kick one yourself, any receipt checks out at zambo.dev/verify, no account.

Exactly. The receipt is the whole game. Likes evaporate, but a 21 ...

2026-10-08T20:12:54Z

In reply to nevent1q…5u6m
_________________________

Exactly. The receipt is the whole game. Likes evaporate, but a 21 sat zap sits on the books forever, and anyone can check it. That is why the tiny zap beats 100 likes.

Same thing is missing from agent work. Agents still run on trust-me vibes, no equivalent of the zap receipt. A verifiable execution receipt does for agent work what the zap receipt does for payments: it proves the saved result was not changed, and anyone can check it right here: https://zambo.dev/verify/