{"api_version":2,"receipt_profile":"zambo-hosted-receipt/1","schema_url":"https://zambo.dev/aer-1/hosted-profile.schema.json","id":"bc2856fd-1669-47bb-b52e-447a85ae3f97","source_url":"https://zambo.dev/api/receipt/bc2856fd-1669-47bb-b52e-447a85ae3f97","receipt":{"id":"bc2856fd-1669-47bb-b52e-447a85ae3f97","created_at":"2026-11-14T00:14:36.625Z","receipt_schema_version":"0.4","job_summary":"MCP tool execution: provibe_audit","tools":["provibe_audit"],"steps":[{"tool":"provibe_audit","completed_at":"2026-11-14T00:14:36.625Z","status":"success"}],"output_hash":"sha256:4ac453779988e31e2ed94e0d70c3ccc71aa894af0e05777f96d1e8e896f17a10","hash_algorithm":"sha256","canonical_bytes":"eyJjYWxsZXIiOnsiaWQiOiJzaGEyNTY6ZTQyYTJlM2FhYTlkMTE1ZDRkZTBkY2RlNTViYTRiZTJlYTRmNGYyYjgxMDBlNmEwZDcwNWEyM2YyMGRlYzM1YyIsInR5cGUiOiJzZXNzaW9uIn0sImlzc3Vlcl9jbGFpbXMiOnsicHJvdmVuYW5jZV9jbGFzcyI6IkxPR0dFRCBCWSBBR0VOVCJ9LCJvdXRwdXQiOnsib3V0cHV0Ijoie1wicmVjZWlwdF9pZFwiOlwiMzY3N2VjNTctYmQ2ZS00MDkyLTg0MDMtMmYyNWRhN2NiOTAxXCIsXCJyZWNlaXB0X3VybFwiOlwiaHR0cHM6Ly96YW1iby5kZXYvcnVuLzM2NzdlYzU3LWJkNmUtNDA5Mi04NDAzLTJmMjVkYTdjYjkwMVwiLFwicHJvdmliZV9zY29yZVwiOjg3LFwidmliZV92ZXJkaWN0XCI6XCJTT0xJRFwiLFwicmlza19sZXZlbFwiOlwiTUVESVVNXCIsXCJlc3RpbWF0ZWRfZml4X3RpbWVcIjpcIjEwIHRvIDE0IGhvdXJzXCIsXCJzY29yZV9icmVha2Rvd25cIjp7XCJzZWN1cml0eVwiOjk1LFwibWFpbnRhaW5hYmlsaXR5XCI6OTAsXCJkZWFkQ29kZVwiOjg4LFwiYXJjaGl0ZWN0dXJlXCI6NzV9LFwic3VtbWFyeVwiOlwiRGV0ZXJtaW5pc3RpYyBzdGF0aWMgYW5hbHlzaXMgY29tcGxldGVkIGJlY2F1c2UgdGhlIEFJIHJldmlldyBwcm92aWRlciB3YXMgdW5hdmFpbGFibGUuIFRoZSBzY29yZSBpcyBiYXNlZCBvbmx5IG9uIGRpcmVjdGx5IG9ic2VydmVkIGNvZGUgYW5kIHJlcG9zaXRvcnkgc2lnbmFsczsgbm8gZmluZGluZ3Mgd2VyZSBpbnZlbnRlZC5cIixcImFyY2hpdGVjdHVyZVwiOlwiU3RhdGljIGZhbGxiYWNrIGluc3BlY3RlZCAyIHNhbXBsZWQgZmlsZShzKSBmcm9tIDYzIHRvdGFsIGZpbGUocykuIEl0IHJlcG9ydHMgcGF0dGVybi1iYXNlZCBldmlkZW5jZSBvbmx5IGFuZCBkb2VzIG5vdCBjbGFpbSBzZW1hbnRpYyBmaW5kaW5ncyB0aGF0IHJlcXVpcmUgYW4gQUkgcmV2aWV3LlwiLFwiZmluZGluZ3NcIjpbe1wic2V2ZXJpdHlcIjpcImhpZ2hcIixcImNhdGVnb3J5XCI6XCJUZXN0aW5nXCIsXCJ0aXRsZVwiOlwiTm8gdGVzdCBmaWxlcyBkZXRlY3RlZFwiLFwiZGVzY3JpcHRpb25cIjpcIlRoZSBmdWxsIHJlcG9zaXRvcnkgdHJlZSBkaWQgbm90IGNvbnRhaW4gYSByZWNvZ25pemVkIHRlc3QgZmlsZSwgbGVhdmluZyBiZWhhdmlvciBjaGFuZ2VzIHVudmVyaWZpZWQuXCIsXCJzdWdnZXN0ZWRGaXhcIjpcIkFkZCBmb2N1c2VkIHRlc3RzIGZvciB0aGUgaGlnaGVzdC1yaXNrIHJlcXVlc3QsIHBlcnNpc3RlbmNlLCBhbmQgYXV0aG9yaXphdGlvbiBwYXRocy5cIn1dLFwidmliZV9zaWduYWxzXCI6e1wiY29uc29sZV9sb2dzXCI6MCxcInRvZG9fY29tbWVudHNcIjowLFwidHNfaWdub3JlX2NvdW50XCI6MCxcImFueV90eXBlX2NvdW50XCI6MCxcInN1c3BlY3RlZF9zZWNyZXRfbGVha3NcIjowLFwiaGFzX3Rlc3RzXCI6ZmFsc2UsXCJ0ZXN0X2ZpbGVfY291bnRcIjowLFwiZW52X2ZpbGVfY29tbWl0dGVkXCI6ZmFsc2UsXCJhc3luY193aXRob3V0X3RyeV9jYXRjaFwiOjAsXCJlbXB0eV9jYXRjaF9ibG9ja3NcIjowfSxcInJlcG9fbWV0YVwiOntcInN0YXJzXCI6MCxcImxhc3RfcHVzaGVkX2RheXNfYWdvXCI6MCxcImxhbmd1YWdlXCI6XCJEb2NrZXJmaWxlXCIsXCJvcGVuX2lzc3Vlc1wiOjEsXCJpc19hcmNoaXZlZFwiOmZhbHNlLFwibGljZW5zZVwiOlwiTUlUIExpY2Vuc2VcIn0sXCJtYWluX2xhbmd1YWdlXCI6XCJKYXZhU2NyaXB0XCIsXCJmaWxlX2NvdW50XCI6NjMsXCJyZXN1bHRfaWRcIjpcIjMxMDlkYjk1LWI4YjQtNGFlMC1hZmM1LTU0ZWY2MDJjOGZmZFwiLFwicmVzdWx0X3VybFwiOlwiaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGU/aWQ9MzEwOWRiOTUtYjhiNC00YWUwLWFmYzUtNTRlZjYwMmM4ZmZkXCIsXCJ1cGdyYWRlX25vdGVcIjpcIlphbWJvIFBhc3MgY29zdHMgJDI5IGZvciAzMCBkYXlzLCBvbmUgcGF5bWVudCwgd2l0aCBsaXN0ZWQgYXVkaXQgYWxsb3dhbmNlcy5cIixcInVwZ3JhZGVfdXJsXCI6XCJodHRwczovL3phbWJvLmRldi9wcm92aWJlY29kZT9pZD0zMTA5ZGI5NS1iOGI0LTRhZTAtYWZjNS01NGVmNjAyYzhmZmRcIixcImlucHV0X3R5cGVcIjpcInJlcG9fdXJsXCIsXCJiYWRnZVwiOntcInVybFwiOlwiaHR0cHM6Ly96YW1iby5kZXYvYXBpL29nL2JhZGdlP3Njb3JlPTg3XCIsXCJtYXJrZG93blwiOlwiWyFbUHJvdmliZUNvZGUgU2NvcmU6IDg3LzEwMF0oaHR0cHM6Ly96YW1iby5kZXYvYXBpL29nL2JhZGdlP3Njb3JlPTg3KV0oaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGUpXCIsXCJodG1sXCI6XCI8YSBocmVmPVxcXCJodHRwczovL3phbWJvLmRldi9wcm92aWJlY29kZVxcXCI+PGltZyBzcmM9XFxcImh0dHBzOi8vemFtYm8uZGV2L2FwaS9vZy9iYWRnZT9zY29yZT04N1xcXCIgYWx0PVxcXCJQcm92aWJlQ29kZSBTY29yZTogODcvMTAwXFxcIiBzdHlsZT1cXFwiaGVpZ2h0OjIwcHhcXFwiIC8+PC9hPlwiLFwidGlwXCI6XCJBZGQgdGhpcyBiYWRnZSB0byB5b3VyIFJFQURNRSB0byBzaG93IHlvdXIgcmVwbydzIFByb3ZpYmVDb2RlIHNjb3JlXCJ9fSIsInJlZGFjdGVkX3Byb2plY3Rpb24iOnRydWUsInNvdXJjZV9jb21taXRtZW50X2NoZWNrZWQiOnRydWUsInNvdXJjZV9vdXRwdXRfaGFzaCI6InNoYTI1NjozMzJlNGExMmVkNDYyOGQ1YmNhNDkyZjkyNzA0YjczODEyNGJhZmQzZjQxOTk4ODgzNzJmMGFmMjgwMTBkYjhkIiwic291cmNlX3JlY2VpcHRfaWQiOiI3YjcyOWU5Yy1kMmJkLTRkMzctOWUyZi01NDUxNWIwMWY4ZjgifSwicmVjZWlwdF9zY2hlbWFfdmVyc2lvbiI6IjAuNCIsInNpZGVfZWZmZWN0cyI6eyJkZWNsYXJhdGlvbl9oYXNoIjoic2hhMjU2OjQ1YWFkMzhmM2FhOTgyYjlhYWZlOTJlY2I0MTZlYmU5ODc5MWVkZGJhZjhhYjZkZjBiZDA4NjA1YjdjMWJmZWUiLCJkZWNsYXJlZCI6WyJub25lIl0sInNjaGVtYV92ZXJzaW9uIjoiemFtYm8tc2lkZS1lZmZlY3RzLzEifSwidG9vbCI6eyJuYW1lIjoicHJvdmliZV9hdWRpdCIsInNjb3BlIjoicHVibGljIiwidmVyc2lvbiI6IjQuMS4wIn19","canonical_bytes_withheld_for_privacy":false,"canonical_byte_length":3012,"verification_status":"verified","session_trail":[],"result_preview":"{\"source_receipt_id\":\"7b729e9c-d2bd-4d37-9e2f-54515b01f8f8\",\"source_output_hash\":\"sha256:332e4a12ed4628d5bca492f92704b738124bafd3f4199888372f0af28010db8d\",\"output\":\"{\\\"receipt_id\\\":\\\"3677ec57-bd6e-4092-8403-2f25da7cb901\\\",\\\"receipt_url\\\":\\\"https://zambo.dev/run/3677ec57-bd6e-4092-8403-2f25da7cb901\\\",\\\"provibe_score\\\":87,\\\"vibe_verdict\\\":\\\"SOLID\\\",\\\"risk_level\\\":\\\"MEDIUM\\\",\\\"estimated_fix_time\\\":\\\"10 to 14 hours\\\",\\\"score_breakdown\\\":{\\\"security\\\":95,\\\"maintainability\\\":90,\\\"deadCode\\\":88,\\\"architecture\\\":75},\\\"summary\\\":\\\"Deterministic static analysis completed because the AI review provider was unavailable. The score is based only on directly observed code and repository signals; no findings were invented.\\\",\\\"architecture\\\":\\\"Static fallback inspected 2 sampled file(s) from 63 total file(s). It reports pattern-based evidence only and does not claim semantic findings that require an AI review.\\\",\\\"findings\\\":[{\\\"severity\\\":\\\"high\\\",\\\"category\\\":\\\"Testing\\\",\\\"title\\\":\\\"No test files detected\\\",\\\"description\\\":\\\"The full repository tree did not contain a recognized test file, leaving behavior changes unverified.\\\",\\\"suggestedFix\\\":\\\"Add focused tests for the highest-risk request, persistence, and authorization paths.\\\"}],\\\"vibe_signals\\\":{\\\"console_logs\\\":0,\\\"todo_comments\\\":0,\\\"ts_ignore_count\\\":0,\\\"any_type_count\\\":0,\\\"suspected_secret_leaks\\\":0,\\\"has_tests\\\":false,\\\"test_file_count\\\":0,\\\"env_file_committed\\\":false,\\\"async_without_try_catch\\\":0,\\\"empty_catch_blocks\\\":0},\\\"repo_meta\\\":{\\\"stars\\\":0,\\\"last_pushed_days_ago\\\":0,\\\"language\\\":\\\"Dockerfile\\\",\\\"open_issues\\\":1,\\\"is_archived\\\":false,\\\"license\\\":\\\"MIT License\\\"},\\\"main_language\\\":\\\"JavaScript\\\",\\\"file_count\\\":63,\\\"result_id\\\":\\\"3109db95-b8b4-4ae0-afc5-54ef602c8ffd\\\",\\\"result_url\\\":\\\"https://zambo.dev/provibecode?id=3109db95-b8b4-4ae0-afc5-54ef602c8ffd\\\",\\\"upgrade_note\\\":\\\"Zambo Pass costs $29 for 30 days, one payment, with listed audit allowances.\\\",\\\"upgrade_url\\\":\\\"https://zambo.dev/provibecode?id=3109db95-b8b4-4ae0-afc5-54ef602c8ffd\\\",\\\"input_type\\\":\\\"repo_url\\\",\\\"badge\\\":{\\\"url\\\":\\\"https://zambo.dev/api/og/badge?score=87\\\",\\\"markdown\\\":\\\"[![ProvibeCode Score: 87/100](https://zambo.dev/api/og/badge?score=87)](https://zambo.dev/provibecode)\\\",\\\"html\\\":\\\"<a href=\\\\\\\"https://zambo.dev/provibecode\\\\\\\"><img src=\\\\\\\"https://zambo.dev/api/og/badge?score=87\\\\\\\" alt=\\\\\\\"ProvibeCode Score: 87/100\\\\\\\" style=\\\\\\\"height:20px\\\\\\\" /></a>\\\",\\\"tip\\\":\\\"Add this badge to your README to show your repo's ProvibeCode score\\\"}}\",\"redacted_projection\":true,\"source_commitment_checked\":true}","result_preview_integrity":"display_only_not_committed","result_preview_truncated":false,"free_used":0,"free_remaining":0,"free_limit":0,"signal_handle":null,"tool":{"name":"provibe_audit","version":"4.1.0","scope":"public"},"caller":{"type":"session","id":"sha256:e42a2e3aaa9d115d4de0dcde55ba4be2ea4f4f2b8100e6a0d705a23f20dec35c"},"side_effects":{"declared":["none"],"schema_version":"zambo-side-effects/1","declaration_hash":"sha256:45aad38f3aa982b9aafe92ecb416ebe98791eddbaf8ab6df0bd08605b7c1bfee"},"evidence_sha256":null,"evidence_url":null,"evidence_byte_length":null,"evidence_content_type":null,"evidence_source_url":null,"evidence_status":"empty","result_source":null,"evidence_source":null,"external_evidence":[],"provenance":null,"provenance_class":"LOGGED BY AGENT","metadata_hash":"sha256:49d237240b1c98d18b092e9f9441d2e0fb7a8284ebe72163a3ce55c3b718bd0a","anchor":{"event_id":"e5d6ca9449191e72e535fc3ad3412ecc4c8ad0358188a3c4a6ecb008e203637c","pubkey":"e13475107d30c918ec664adf2ab1141024a22fb35190f82c9e933704fa49af41","relays":["wss://relay.primal.net"],"status":"published","published_at":"2026-11-14T00:14:37.183Z","published_at_semantics":"Relay confirmation time (accepted acknowledgement or exact-event read-back); not the signed event's created_at.","schema_version":"zambo-receipt-anchor/1","envelope":{"anchored_at":"2026-11-14T00:14:36.625Z","evidence_url":null,"receipt_uuid":"bc2856fd-1669-47bb-b52e-447a85ae3f97","output_sha256":"sha256:4ac453779988e31e2ed94e0d70c3ccc71aa894af0e05777f96d1e8e896f17a10","schema_version":"zambo-receipt-anchor/1","evidence_sha256":null,"evidence_byte_length":null},"envelope_bytes":"{\"anchored_at\":\"2026-11-14T00:14:36.625Z\",\"evidence_byte_length\":null,\"evidence_sha256\":null,\"evidence_url\":null,\"output_sha256\":\"sha256:4ac453779988e31e2ed94e0d70c3ccc71aa894af0e05777f96d1e8e896f17a10\",\"receipt_uuid\":\"bc2856fd-1669-47bb-b52e-447a85ae3f97\",\"schema_version\":\"zambo-receipt-anchor/1\"}"},"receipt_profile":"zambo-hosted-receipt/1","schema_url":"https://zambo.dev/aer-1/hosted-profile.schema.json","api_version":1,"verification_scope":"separate_sha256_commitment_and_provenance_binding_checks","checks":{"commitment_matches":{"label":"SHA-256 commitment","passed":true,"status":"pass","detail":"The exact decoded canonical bytes match the stored SHA-256 output hash."},"canonical_payload_matches":{"label":"Canonical payload reconstruction","passed":true,"status":"pass","detail":"The stored output and known call context reconstruct the exact canonical bytes."},"provenance_binding":{"label":"Provenance claim binding","status":"pass","passed":true,"detail":"The metadata claim is consistent with the verified receipt bytes; issuer is not authenticated."},"metadata_binding":{"label":"AER-1 metadata hash","status":"pass","passed":true,"detail":"metadata_hash matches the canonical metadata block."},"signature":{"label":"Ed25519 signature (not checked)","passed":false,"status":"not_checked","detail":"No Ed25519 signature or pinned signing key was checked."},"chain":{"label":"Receipt chain (not checked)","passed":false,"status":"not_checked","detail":"No append-only receipt-chain proof was checked."},"issued_by_zambo_dev":{"label":"Issuer authentication","passed":false,"status":"not_checked","detail":"A zambo.dev receipt URL does not authenticate the issuer; no pinned signature or trusted issuer key was checked."},"immutable_log_timestamp":{"label":"Stored timestamp","passed":true,"timestamp":"2026-11-14T00:14:36.625Z","detail":"The receipt store reports 2026-11-14T00:14:36.625Z; immutability is not checked here."},"receipt_schema_version":"0.4","signature_valid":{"label":"Ed25519 signature (not checked)","passed":false,"status":"not_checked","detail":"Compatibility field only. No Ed25519 signature was checked; use API v2 checks.commitment_matches for the SHA-256 commitment."},"chain_valid":{"label":"Receipt chain (not checked)","passed":false,"status":"not_checked","detail":"This endpoint does not verify an append-only chain."}}},"evidence_status":"empty","verification_status":"verified","checks":{"commitment_matches":{"status":"pass","passed":true,"expected_hash":"sha256:4ac453779988e31e2ed94e0d70c3ccc71aa894af0e05777f96d1e8e896f17a10","computed_hash":"sha256:4ac453779988e31e2ed94e0d70c3ccc71aa894af0e05777f96d1e8e896f17a10","detail":"SHA-256 of the exact decoded canonical bytes matches output_hash."},"canonical_payload_matches":{"label":"Canonical payload reconstruction","passed":true,"status":"pass","detail":"The stored output and known call context reconstruct the exact canonical bytes."},"provenance_binding":{"label":"Provenance claim binding","status":"pass","passed":true,"detail":"The metadata claim is consistent with the verified receipt bytes; issuer is not authenticated."},"metadata_binding":{"label":"AER-1 metadata hash","status":"pass","passed":true,"detail":"metadata_hash matches the canonical metadata block."},"issuer_authentication":{"label":"Issuer authentication","passed":false,"status":"not_checked","detail":"A zambo.dev receipt URL does not authenticate the issuer; no pinned signature or trusted issuer key was checked."},"signature":{"status":"not_checked","detail":"No Ed25519 signature or pinned signing key is supplied."},"schema":{"status":"not_checked","detail":"Schema conformance is left to the client using the linked hosted-profile schema."},"chain":{"status":"not_checked","detail":"This endpoint does not verify an append-only receipt chain."}}}