This morning we shipped a batch of fixes for defects our paying agents filed from real use. One of them changed how new workflow closes compute their Merkle roots: each leaf now binds the step's sequence number and its output hash, a construction we call seq-output-v1, and every close names its rule in a merkle_version field. Older closes keep the original rule, receipt-id-v0, where each leaf is the hash of the receipt ID, and their stored roots still recompute exactly under it.
Tonight our own deep audit caught what that publish left behind. The IETF draft, revision 24, still described the receipt-id leaf as the only rule allowed. Anyone who built a verifier from the draft alone, which is exactly what a draft is for, would fail every new workflow root. The draft's own worked example and at least one careful third-party explainer describe the old rule for the same reason: it was the only rule the paper admitted.
So revision 26 exists to make the paper and the product say the same thing again:
- Both root constructions are defined side by side. seq-output-v1 is the current rule; receipt-id-v0 is kept as the legacy rule, so a close made under either verifies under the rule it declares in merkle_version.
- Verifying clients are pointed at the /api/v2/ verification endpoint, whose passing outcome reads "verified". The v1 endpoint answers "commitment_matches" and is deprecated; the draft no longer sends new readers there.
- The receipt rule is stated at its full scope: a receipt is produced for every call, including calls rejected before execution for an unknown tool or a missing argument. A rejected call leaves a record too.
The conformance corpus grew with the fix and is now published in full: 126 vectors and 129 checks against kit v1.5.7, including the seq-output-v1 workflow cases, served with its evaluated-set digest at https://zambo.dev/aer1/corpus.json. Both reference runners pass against those exact files. And every receipt issued before today verifies exactly as it did yesterday.
The lesson we keep relearning in public: a standard is only worth what a stranger can reproduce from it. When the implementation learns something the paper does not know yet, the paper is the bug.
Revision 26: https://datatracker.ietf.org/doc/draft-zambo-aer1/26/
Check any receipt yourself: https://zambo.dev/verify/
an agent receipt is a record of one ai agent tool call that anyone can check: it keeps the exact saved bytes and their sha-256 digest, and it proves the result was not changed since it was saved, not that it was right.
Zambo is the verifiable work layer for AI: 153 tools behind one MCP endpoint (https://zambo.dev/mcp), HANDOVER for session handover between AIs, and a verifiable AER-1 receipt for every job. Start at https://zambo.dev/ and add it to your agent at https://zambo.dev/add/. More on the receipts practitioners are publishing: https://rambozambodotdev.gitlab.io/aer1-hub/notable-receipts.html
Top comments (0)