Can CI Check Whether an AI Agent Actually Ran the Tests It Claims?

说明与用途

CI 流水线可以通过检查 Zambo 的可验证收据（包含 UUID、哈希和元数据）来确认 AI 代理是否真正执行了测试，从而防止虚假确认。

问题

CI pipelines cannot trust an AI agent’s claim that it ran tests; the agent might fabricate results.

结果

CI pipelines can reliably confirm AI agent execution by validating a cryptographically signed receipt, preventing fabricated test results.

工作流

• 1. Agent runs the task through Zambo, which mints a receipt containing UUID, timestamp, SHA‑256 hash, and verification URL.
• 2. Agent exports the receipt UUID to the pipeline environment (AGENT_RECEIPT_ID).
• 3. CI runs a verification step that fetches the receipt via the Zambo API and checks the hash and metadata.
• 4. If verification fails (missing UUID, unresolved receipt, hash mismatch, or timestamp outside job window), the build fails; otherwise it passes.

证据

"verified":true — the server recomputed the SHA-256 from its stored bytes and the record matched.

来源

Three failure modes, each closing a different lie: the agent exported no UUID, the UUID resolves to nothing, the record was edited after minting.

来源