Can CI Check Whether an AI Agent Actually Ran the Tests It Claims?

Описание и применение

Пайплайн CI может проверить, действительно ли AI‑агент выполнил тесты, используя проверяемый чек Zambo, который содержит UUID, хеш и метаданные. Это предотвращает ложные подтверждения.

Задача

CI pipelines cannot trust an AI agent’s claim that it ran tests; the agent might fabricate results.

Результат

CI pipelines can reliably confirm AI agent execution by validating a cryptographically signed receipt, preventing fabricated test results.

Рабочий процесс

• 1. Agent runs the task through Zambo, which mints a receipt containing UUID, timestamp, SHA‑256 hash, and verification URL.
• 2. Agent exports the receipt UUID to the pipeline environment (AGENT_RECEIPT_ID).
• 3. CI runs a verification step that fetches the receipt via the Zambo API and checks the hash and metadata.
• 4. If verification fails (missing UUID, unresolved receipt, hash mismatch, or timestamp outside job window), the build fails; otherwise it passes.

Доказательства

"verified":true — the server recomputed the SHA-256 from its stored bytes and the record matched.

Источник

Three failure modes, each closing a different lie: the agent exported no UUID, the UUID resolves to nothing, the record was edited after minting.

Источник