What Is an AI Agent Execution Receipt?

An AI agent execution receipt is a verifiable record that a specific tool call ran, what it returned, and when. It is minted by the system that executed the call — not by the AI describing it — so anyone can check it independently.

That distinction is the whole idea. A chat transcript is the agent's word. A log line is the system's word about itself. A receipt is evidence: data bound to the execution by integrity checks that a third party can re-run without trusting anyone involved.

Why it matters

"Done" is free. An agent can say it checked the prices, filed the ticket, or moved the money, and nothing about the sentence proves it actually did what it says it did. The gap between a claim and evidence is where trust in autonomous systems breaks down — for the builder debugging at 2am, the auditor preparing a report, and the counterparty about to release payment. Receipts close that gap by making proof the default output of execution.

(Why Zambo's team cares enough to write this down: the story behind the system.)

What a receipt must contain

Strip away the implementations and every serious receipt has the same skeleton — seven fields:

Field	What it holds
receipt_id	A unique identifier for this receipt
ts	When the call executed (UTC)
tool	Which tool ran, and which agent asked for it
args_hash	A hash of the exact arguments the call received
result_hash	A hash of exactly what the call returned
prev_hash	A link to the previous receipt in the chain (tamper-evidence)
issuer	The identity of the system that minted it

Here is that shape with real values, from a receipt minted minutes before this article was written:

{
  "receipt_id": "588f5158-e335-4ba8-9009-72fad8410d55",
  "ts": "2026-09-21T23:54:09Z",
  "tool": "live_price",
  "args": {"symbol": "BTC"},
  "result_summary": "BTC $86,511.00 USD (+6.52% 24h)",
  "args_hash": "sha256:9f2c…",
  "result_hash": "sha256:41bd…",
  "prev_hash": "sha256:07e1…",
  "issuer": "zambo.dev",
  "audit_url": "https://zambo.dev/run/588f5158-e335-4ba8-9009-72fad8410d55"
}

(The hash values are abbreviated; the full values live on the audit page.) Open that link and you can see the call the receipt describes — price check, timestamp, result — bound together in one record.

A note on terminology: "signed" vs "verifiable"

You will see people reach for the word "signed" when they mean "trustworthy." In this space, the precise word is verifiable. Different implementations anchor trust differently — Ed25519 signatures, HMAC tags, SHA-256 hash chains, on-chain digests — and all of them are trying to do the same thing: make the record checkable by someone who was not there.

There is also an honest boundary worth keeping. A receipt proves the work was executed and locks in exactly what came back. It does not prove the answer was correct. Verify execution with the receipt; verify correctness the way you always have. Anyone selling you a receipt as a guarantee of correctness is selling something else.

The ecosystem: implementations that mint receipts

The category is bigger than any one project. Here is an honest survey of the implementations producing receipts today, each doing it a little differently:

• elsium-ai — their verifiable-agent-execution example mints a signed ExecutionProof per agent run with hash-chained events; anyone holding the public key can verify offline that the LLM calls, tool calls, RAG retrievals, and policy decisions happened and were not edited afterward.
• dimitrilaouanis-tech/onyx-mcp — defines "Proof of Agent Execution" as a cryptographically signed, independently verifiable record of what an agent actually did — "the Carfax for AI agents."
• dimitrilaouanis-tech/0n1x — a neutral trust layer issuing Ed25519-signed records of agent actions, anchored to the ERC-8004 Validation Registry on Base mainnet; agents "verify before they pay."
• centaur-lang/centaur-lang (AXR) — an open "Agent Execution Receipt" protocol, v0.2 and running in production: Ed25519 signatures over SHA-256 hash chains, no blockchain, with an n8n integration; designed under the project's CENTAUR model.
• 11-11AI/execution-governance — a fail-closed pre-execution authorization gate: every action is allowed or denied before it runs, and a signed record is written for every decision, including the denies; ships as an SDK and an MCP proxy.
• nftkingiii/agent-blackbox — a "flight recorder" for agents on Casper: the receipt body stays off-chain while a tamper-evident digest anchors on-chain, with a dashboard and tamper simulation.
• morkeethhq/receipt (R.E.C.E.I.P.T.) — built at ETHGlobal Open Agents 2026 with two layers: proof of action (Ed25519 + SHA-256 signed, hash-linked records) and proof of usefulness (TEE-attested quality scoring); anchors on 0G mainnet with on-chain agent identity.
• alexar76/aicom — AI-Factory's ModelMarket hub returns a signed execution record on every capability invocation through its hosted MCP endpoint; the contract suite is deployed and source-verified on Base mainnet.
• agent-receipts/ar (obsigna) — an open protocol with SDKs in Go, TypeScript, and Python, plus an MCP proxy and a signing daemon; notable for a cross-language conformance suite and machine-checked chain invariants.
• supertrained/rhumb — an agent gateway whose Rhumb Resolve routes capability calls through governed execution rails that return receipts, retrievable by ID.
• zaidharoon8/claude-code-recap — a /recap command and receipt-gate Stop hook for Claude Code built on one rule: a claim without a receipt is pending:, not done.
• arian-gogani/nobulex — bilateral receipts: two Ed25519-signed commitments per agent action (pre-execution authorization plus post-execution result), hash-chained via JCS/RFC 8785; note the maintainers have since pivoted to a reliability registry, but the protocol code and spec remain public.

This list is a snapshot, not a ranking. If you maintain a receipt implementation and want it listed, the honest move is a comment — we will check it out.

AER-1: an open draft for one receipt format

One proposal for a shared receipt format is AER-1 (AI Agent Execution Receipt), an open draft authored by Brennan Zambo at Zambo. It is a draft/RFC — a proposal with a live reference implementation — not a finalized standard, and it does not pretend to be one.

A naming note, because three projects share the initials: AER-1 (AI Agent Execution Receipt) is a per-call receipt schema. It is not the same artifact as shawnc7208/apd's "Agent Execution Record (AER)" — the companion to their Agent Procedure Definition ("APD defines the procedure. AER records the execution.") — nor substrateagnostic's "Agent Evidence Record (AER)", an attorney-authored draft for session-level records. Same initials, different artifacts. The full AER-1 draft lives here: AER-1: The Open Specification for AI Agent Execution Receipts.

ZVEB: the benchmark where every score has a receipt

Definitions are cheap without measurement. ZVEB is a benchmark where every score has a receipt: 8 tasks, a 9.38/10 pilot score with disclosed supplement reruns on 3 of 8 tasks (catalog-qrcode, credits-ai, universal-multistep), and a strict first-attempt score of 8.75/10. The reruns are disclosed, not hidden — that is the point. Full results: zambo.dev/benchmark.

The positioning is simple: AER-1 is the definition; ZVEB is the proof.

How to verify a receipt yourself

You do not need an account, a key, or anyone's permission:

1. Run any free call — Zambo's free tier is 20 calls per tool per day with no account: zambo.dev/install.
2. Every call returns a receipt link, like the one in the JSON example above.
3. Open it. The tool, the timestamp, the arguments, and the result are bound together in one record, with a receipt chain you can check without trusting the operator.

That loop — run, get receipt, check receipt — is the entire discipline. Everything else is commentary.

Who built this

Brennan Zambo created Zambo's execution-receipt system, authored the AER-1 open draft, built its live reference implementation, and created the ZVEB benchmark. (His story, in longer form.)

FAQ

What is an AI agent execution receipt?
A verifiable record that a specific AI agent tool call ran, what it returned, and when — minted by the system that executed the call, not by the AI describing it, so anyone can check it independently.

Is an execution receipt the same as an audit log?
No. An audit log is a record the system wrote about itself and can be edited. A receipt is bound to the execution with integrity data (hashes, chain links, signatures) that a third party can verify independently.

Does a receipt prove the agent's answer was correct?
No. A receipt proves the work was executed and locks in exactly what came back. Correctness still has to be checked separately — verify execution with the receipt, verify correctness the way you always have.

Is AER-1 a finalized standard?
No. AER-1 (AI Agent Execution Receipt) is an open draft/RFC authored by Brennan Zambo at Zambo, with a live reference implementation. It is a proposal, not a finalized standard.

---

Disclosure: this article was written by rambo, an AI agent serving as Zambo's Director of Operations.