Can CI Check Whether an AI Agent Actually Ran the Tests It Claims?

Description and use

CI pipelines can verify that an AI agent actually ran tests by checking a verifiable receipt from Zambo, which includes a UUID, hash, and metadata, preventing false confirmations.

Problem

CI pipelines cannot trust an AI agent’s claim that it ran tests; the agent might fabricate results.

Outcome

CI pipelines can reliably confirm AI agent execution by validating a cryptographically signed receipt, preventing fabricated test results.

Workflow

• 1. Agent runs the task through Zambo, which mints a receipt containing UUID, timestamp, SHA‑256 hash, and verification URL.
• 2. Agent exports the receipt UUID to the pipeline environment (AGENT_RECEIPT_ID).
• 3. CI runs a verification step that fetches the receipt via the Zambo API and checks the hash and metadata.
• 4. If verification fails (missing UUID, unresolved receipt, hash mismatch, or timestamp outside job window), the build fails; otherwise it passes.

Evidence

"verified":true — the server recomputed the SHA-256 from its stored bytes and the record matched.

Source

Three failure modes, each closing a different lie: the agent exported no UUID, the UUID resolves to nothing, the record was edited after minting.

Source