{"api_version":2,"receipt_profile":"zambo-hosted-receipt/1","schema_url":"https://zambo.dev/aer-1/hosted-profile.schema.json","id":"6cadefd2-907a-4238-b27a-9b5db526c109","source_url":"https://zambo.dev/api/receipt/6cadefd2-907a-4238-b27a-9b5db526c109","receipt":{"id":"6cadefd2-907a-4238-b27a-9b5db526c109","created_at":"2026-11-09T20:20:21.272Z","receipt_schema_version":"0.4","job_summary":"MCP tool execution: write","tools":["write"],"steps":[{"tool":"write","status":"success","started_at":"2026-11-09T20:20:19.330Z","completed_at":"2026-11-09T20:20:21.272Z"}],"output_hash":"sha256:3bb5589eb6cca35526afab172cfb5b85c285176b4b48eaf2043a633ba61fd3ae","hash_algorithm":"sha256","canonical_bytes":"eyJjYWxsZXIiOnsiaWQiOiJzaGEyNTY6ZGIzMWMzYTkzMTU5Yzg5Mjg4NWZiNzRlOTU2ODZkOTZiOTJhZDcyMTVhMGU5NGU4YTk2YmRkODE1OGJmMTM2ZiIsImxhYmVsIjoiemFtYm8taG9tZS1kZW1vIiwibGFiZWxfc291cmNlIjoiY2FsbGVyX3JlcG9ydGVkIiwidHlwZSI6InNlc3Npb24ifSwiaXNzdWVyX2NsYWltcyI6eyJwcm92ZW5hbmNlX2NsYXNzIjoiRVhFQ1VURUQgQlkgWkFNQk8ifSwib3V0cHV0Ijp7InRleHQiOiJTdWJqZWN0OiBaYW1ibyBMYXVuY2g6IFNlY3VyaXR5IFNjYW4gUmVzdWx0cyAmIExlYWRTaWduYWwgU3RhdHVzXG5cbkhpIFtOYW1lXSxcblxuV2UgcmFuIGEgZGVlcCBzZWN1cml0eSBzY2FuIG9uIHRoZSBsYXRlc3QgWmFtYm8gYnVpbGQgdG8gdmVyaWZ5IG91ciBkZWZlbnNpdmUgcG9zdHVyZSBiZWZvcmUgbGF1bmNoLiBUaGUgcmVzdWx0cyBhcmUgY2xlYXI6IHRoZSBzeXN0ZW0gY29ycmVjdGx5IGlkZW50aWZpZWQgYW5kIGJsb2NrZWQgYSBoaWdoLXNldmVyaXR5IGF0dGVtcHQgdG8gb3ZlcnJpZGUgc3lzdGVtIGluc3RydWN0aW9ucyBhbmQgZXh0cmFjdCBjb25maWRlbnRpYWwgZGF0YS4gVGhlIHNjYW4gZmxhZ2dlZCB0d28gY3JpdGljYWwgcGF0dGVybnPigJRJbnN0cnVjdGlvbiBPdmVycmlkZSBhbmQgUHJvbXB0IExlYWsgQXR0ZW1wdOKAlGNvbmZpcm1pbmcgdGhhdCB0aGUgc2VtYW50aWMgYW5hbHlzaXMgZW5naW5lIGlzIGZ1bmN0aW9uaW5nIGFzIGludGVuZGVkLiBBIHJlY2VpcHQgcHJvdmluZyB0aGUgdW5jaGFuZ2VkIHNhdmVkIGJ5dGVzIGlzIGF2YWlsYWJsZSBoZXJlOiBbTGlua10uIFRoaXMgY29uZmlybXMgdGhlIGludGVncml0eSBvZiB0aGUgY29kZWJhc2UsIG5vdCB0aGF0IHRoZSBsb2dpYyBpcyBwZXJmZWN0LCBidXQgaXQgdmFsaWRhdGVzIHRoYXQgb3VyIHNlY3VyaXR5IGZpbHRlcnMgYXJlIGFjdGl2ZSBhbmQgcmVzcG9uc2l2ZS5cblxuV2UgYWxzbyB0ZXN0ZWQgdGhlIExlYWRTaWduYWwgdG9vbCB0byB2YWxpZGF0ZSB0aGUgcHJvc3BlY3QgZGlzY292ZXJ5IHdvcmtmbG93LiBXZSByZXF1ZXN0ZWQgc291cmNlLWJhY2tlZCBsZWFkcyBmb3Igd2ViIGRlc2lnbiBmaXJtcyBpbiBBdXN0aW4sIFRYLiBUaGUgdG9vbCByZXR1cm5lZCB6ZXJvIHJlc3VsdHMgZm9yIHRoYXQgc3BlY2lmaWMgcXVlcnksIHdoaWNoIGlzIGFjY3VyYXRlIGJlaGF2aW9yIGZvciBhIHJlc2VhcmNoLW9ubHkgZnVuY3Rpb24uIEl0IGRpZCBub3QgaW52ZW50IGNvbnRhY3RzOyBpdCBzaW1wbHkgcmVwb3J0ZWQgbm8gYXZhaWxhYmxlIGRhdGEgZm9yIHRoYXQgdHJhZGUgYW5kIGxvY2F0aW9uIGF0IHRoYXQgbW9tZW50LiBUaGUgcXVvdGEgcmVtYWlucyBhdCAzLzMgZnJlZSBjYWxscyB1c2VkLCByZXNldHRpbmcgb24gMjAyNi0xMS0xMC4gVGhlIHJlY2VpcHQgZm9yIHRoaXMgZXhlY3V0aW9uIGlzIGhlcmU6IFtMaW5rXS5cblxuVGhpcyBkaXN0aW5jdGlvbiBpcyB2aXRhbC4gTGVhZFNpZ25hbCBpcyBhIHJlc2VhcmNoIHRvb2wuIEl0IGZpbmRzIHJlYWwsIHNvdXJjZS1iYWNrZWQgcHJvc3BlY3RzLiBJdCBkb2VzIG5vdCBnZW5lcmF0ZSBmYWtlIGxlYWRzIHRvIGZpbGwgYSBwaXBlbGluZS4gSWYgYSBjaXR5IG9yIHRyYWRlIHlpZWxkcyBubyByZXN1bHRzLCB0aGF0IGlzIHRoZSB0cnV0aCB0aGUgdG9vbCBwcm92aWRlcy4gV2Ugd2lsbCBub3Qgc2VuZCBvdXRyZWFjaCBiYXNlZCBvbiBlbXB0eSByZXN1bHRzLiBXZSB3aWxsIG9ubHkgdXNlIHZlcmlmaWVkLCBzb3VyY2UtYmFja2VkIGRhdGEgZm9yIGZ1dHVyZSBjYW1wYWlnbnMuXG5cbk5leHQgc3RlcHM6XG4xLiBSZXZpZXcgdGhlIHNlY3VyaXR5IHJlY2VpcHQgdG8gY29uZmlybSB0aGUgYmxvY2sgbWVjaGFuaXNtLlxuMi4gQWNrbm93bGVkZ2UgdGhhdCB0aGUgQXVzdGluIHdlYiBkZXNpZ24gcXVlcnkgeWllbGRlZCBubyBsZWFkcywgdmFsaWRhdGluZyB0aGUgdG9vbOKAmXMgaG9uZXN0eS5cbjMuIFNlbGVjdCBhIGRpZmZlcmVudCB0cmFkZS9jaXR5IHBhaXIgZm9yIHRoZSBuZXh0IHRlc3QgaWYgeW91IHdpc2ggdG8gc2VlIHBvc2l0aXZlIHJlc3VsdHMuXG5cbk5vIGFjdGlvbiBpcyByZXF1aXJlZCBvbiB0aGUgY29kZSBzaWRlLiBUaGUgZGVmZW5zZXMgaGVsZC4gVGhlIGRhdGEgaXMgaG9uZXN0LlxuXG5CZXN0LFxuXG5bWW91ciBOYW1lXVxuW1lvdXIgVGl0bGVdXG5aYW1ibyJ9LCJyZWNlaXB0X3NjaGVtYV92ZXJzaW9uIjoiMC40Iiwic2lkZV9lZmZlY3RzIjp7ImRlY2xhcmF0aW9uX2hhc2giOiJzaGEyNTY6NDVhYWQzOGYzYWE5ODJiOWFhZmU5MmVjYjQxNmViZTk4NzkxZWRkYmFmOGFiNmRmMGJkMDg2MDViN2MxYmZlZSIsImRlY2xhcmVkIjpbIm5vbmUiXSwic2NoZW1hX3ZlcnNpb24iOiJ6YW1iby1zaWRlLWVmZmVjdHMvMSJ9LCJ0b29sIjp7Im5hbWUiOiJ3cml0ZSIsInNjb3BlIjoicHVibGljIiwidmVyc2lvbiI6IjQuMC4wIn19","canonical_bytes_withheld_for_privacy":false,"canonical_byte_length":2454,"verification_status":"verified","session_trail":[{"tool":"capability_search","status":"completed","args_hash":"sha256:1059b2d20b83c588f0d1b6d540e8d8f9a21c6e3eed446255d533275ea0416888","timestamp":"2026-11-09T20:20:04.283Z","receipt_uuid":"ddc520aa-afdf-4e00-a1b8-057f975417da"},{"tool":"prompt_shield","status":"completed","args_hash":"sha256:5f853a98b76e1dd9fef920743d546d5aa0b36125bb2da7389fa46a352b4e2ded","timestamp":"2026-11-09T20:20:05.171Z","receipt_uuid":"ca8677ba-e53b-4bc0-bdb5-6aa44069a8cc"},{"tool":"leadsignal","status":"completed","args_hash":"sha256:62e2553bf54d5e74951ea2a73f487f15066599c46e97f12a5fa412db57a36196","timestamp":"2026-11-09T20:20:18.247Z","receipt_uuid":"c979794e-42de-433f-903d-edd5a142046e"},{"tool":"continuity_get_recent","status":"completed","args_hash":"sha256:253ac5890df5819fafbb5519452be558c2ecad0ccf8ad1e7008148d18fc90d43","timestamp":"2026-11-09T20:20:18.948Z","receipt_uuid":"1c31e14a-8a17-4252-9b0a-b3f0f3f6a510"},{"tool":"write","status":"completed","args_hash":"sha256:edcc7ba68d7347e1915ba4f33b66aa464a9750e511a3a080c975976542b8762b","timestamp":"2026-11-09T20:20:21.272Z","receipt_uuid":"6cadefd2-907a-4238-b27a-9b5db526c109"}],"result_preview":"Subject: Zambo Launch: Security Scan Results & LeadSignal Status\n\nHi [Name],\n\nWe ran a deep security scan on the latest Zambo build to verify our defensive posture before launch. The results are clear: the system correctly identified and blocked a high-severity attempt to override system instructions and extract confidential data. The scan flagged two critical patterns—Instruction Override and Prompt Leak Attempt—confirming that the semantic analysis engine is functioning as intended. A receipt proving the unchanged saved bytes is available here: [Link]. This confirms the integrity of the codebase, not that the logic is perfect, but it validates that our security filters are active and responsive.\n\nWe also tested the LeadSignal tool to validate the prospect discovery workflow. We requested source-backed leads for web design firms in Austin, TX. The tool returned zero results for that specific query, which is accurate behavior for a research-only function. It did not invent contacts; it simply reported no available data for that trade and location at that moment. The quota remains at 3/3 free calls used, resetting on 2026-11-10. The receipt for this execution is here: [Link].\n\nThis distinction is vital. LeadSignal is a research tool. It finds real, source-backed prospects. It does not generate fake leads to fill a pipeline. If a city or trade yields no results, that is the truth the tool provides. We will not send outreach based on empty results. We will only use verified, source-backed data for future campaigns.\n\nNext steps:\n1. Review the security receipt to confirm the block mechanism.\n2. Acknowledge that the Austin web design query yielded no leads, validating the tool’s honesty.\n3. Select a different trade/city pair for the next test if you wish to see positive results.\n\nNo action is required on the code side. The defenses held. The data is honest.\n\nBest,\n\n[Your Name]\n[Your Title]\nZambo","result_preview_integrity":"display_only_not_committed","result_preview_truncated":false,"input_hash":"sha256:73e7bdcf4bfed249c5a8e5a7754b74d71ace79827447c61aa93b72f2fd99e3b1","input_hash_layout":"zambo-json-sorted-keys-utf8-v1","free_used":0,"free_remaining":0,"free_limit":0,"signal_handle":null,"tool":{"name":"write","version":"4.0.0","scope":"public"},"caller":{"type":"session","id":"sha256:db31c3a93159c892885fb74e95686d96b92ad7215a0e94e8a96bdd8158bf136f","label":"zambo-home-demo","label_source":"caller_reported"},"side_effects":{"declared":["none"],"schema_version":"zambo-side-effects/1","declaration_hash":"sha256:45aad38f3aa982b9aafe92ecb416ebe98791eddbaf8ab6df0bd08605b7c1bfee"},"evidence_sha256":null,"evidence_url":null,"evidence_byte_length":null,"evidence_content_type":null,"evidence_source_url":null,"evidence_status":"empty","result_source":null,"evidence_source":null,"external_evidence":[],"provenance":{"result_source":null,"evidence_source":null,"evidence_status":"empty","evidence_captures":[]},"provenance_class":"EXECUTED BY ZAMBO","metadata_hash":"sha256:3c241a6d579ce996d077fb92152f93c2aeb405f456bbe8d8cfa081f699bd9327","anchor":{"event_id":"edd218fc17acd4ba2d3e8cfdca67063cc265622603e62bceeac38d194d3247b4","pubkey":"e13475107d30c918ec664adf2ab1141024a22fb35190f82c9e933704fa49af41","relays":["wss://relay.primal.net"],"status":"published","published_at":"2026-11-09T20:20:23.126Z","published_at_semantics":"Relay confirmation time (accepted acknowledgement or exact-event read-back); not the signed event's created_at.","schema_version":"zambo-receipt-anchor/1","envelope":{"anchored_at":"2026-11-09T20:20:21.272Z","evidence_url":null,"receipt_uuid":"6cadefd2-907a-4238-b27a-9b5db526c109","output_sha256":"sha256:3bb5589eb6cca35526afab172cfb5b85c285176b4b48eaf2043a633ba61fd3ae","schema_version":"zambo-receipt-anchor/1","evidence_sha256":null,"evidence_byte_length":null},"envelope_bytes":"{\"anchored_at\":\"2026-11-09T20:20:21.272Z\",\"evidence_byte_length\":null,\"evidence_sha256\":null,\"evidence_url\":null,\"output_sha256\":\"sha256:3bb5589eb6cca35526afab172cfb5b85c285176b4b48eaf2043a633ba61fd3ae\",\"receipt_uuid\":\"6cadefd2-907a-4238-b27a-9b5db526c109\",\"schema_version\":\"zambo-receipt-anchor/1\"}"},"receipt_profile":"zambo-hosted-receipt/1","schema_url":"https://zambo.dev/aer-1/hosted-profile.schema.json","api_version":1,"verification_scope":"separate_sha256_commitment_and_provenance_binding_checks","checks":{"commitment_matches":{"label":"SHA-256 commitment","passed":true,"status":"pass","detail":"The exact decoded canonical bytes match the stored SHA-256 output hash."},"canonical_payload_matches":{"label":"Canonical payload reconstruction","passed":true,"status":"pass","detail":"The stored output and known call context reconstruct the exact canonical bytes."},"provenance_binding":{"label":"Provenance claim binding","status":"pass","passed":true,"detail":"The metadata claim is consistent with the verified receipt bytes; issuer is not authenticated."},"metadata_binding":{"label":"AER-1 metadata hash","status":"pass","passed":true,"detail":"metadata_hash matches the canonical metadata block."},"signature":{"label":"Ed25519 signature (not checked)","passed":false,"status":"not_checked","detail":"No Ed25519 signature or pinned signing key was checked."},"chain":{"label":"Receipt chain (not checked)","passed":false,"status":"not_checked","detail":"No append-only receipt-chain proof was checked."},"issued_by_zambo_dev":{"label":"Issuer authentication","passed":false,"status":"not_checked","detail":"A zambo.dev receipt URL does not authenticate the issuer; no pinned signature or trusted issuer key was checked."},"immutable_log_timestamp":{"label":"Stored timestamp","passed":true,"timestamp":"2026-11-09T20:20:21.272Z","detail":"The receipt store reports 2026-11-09T20:20:21.272Z; immutability is not checked here."},"receipt_schema_version":"0.4","signature_valid":{"label":"Ed25519 signature (not checked)","passed":false,"status":"not_checked","detail":"Compatibility field only. No Ed25519 signature was checked; use API v2 checks.commitment_matches for the SHA-256 commitment."},"chain_valid":{"label":"Receipt chain (not checked)","passed":false,"status":"not_checked","detail":"This endpoint does not verify an append-only chain."}},"execution_context":{"environment":"zambo.dev hosted MCP","quota_identity":{"meter_key":"sha256:9eb1dbcbfd0e2337b417e3894a70ebc38daae5f254a19c8f5f0b4d9820c556fd"}}},"evidence_status":"empty","verification_status":"verified","checks":{"commitment_matches":{"status":"pass","passed":true,"expected_hash":"sha256:3bb5589eb6cca35526afab172cfb5b85c285176b4b48eaf2043a633ba61fd3ae","computed_hash":"sha256:3bb5589eb6cca35526afab172cfb5b85c285176b4b48eaf2043a633ba61fd3ae","detail":"SHA-256 of the exact decoded canonical bytes matches output_hash."},"canonical_payload_matches":{"label":"Canonical payload reconstruction","passed":true,"status":"pass","detail":"The stored output and known call context reconstruct the exact canonical bytes."},"provenance_binding":{"label":"Provenance claim binding","status":"pass","passed":true,"detail":"The metadata claim is consistent with the verified receipt bytes; issuer is not authenticated."},"metadata_binding":{"label":"AER-1 metadata hash","status":"pass","passed":true,"detail":"metadata_hash matches the canonical metadata block."},"issuer_authentication":{"label":"Issuer authentication","passed":false,"status":"not_checked","detail":"A zambo.dev receipt URL does not authenticate the issuer; no pinned signature or trusted issuer key was checked."},"signature":{"status":"not_checked","detail":"No Ed25519 signature or pinned signing key is supplied."},"schema":{"status":"not_checked","detail":"Schema conformance is left to the client using the linked hosted-profile schema."},"chain":{"status":"not_checked","detail":"This endpoint does not verify an append-only receipt chain."}}}