Verifiable receipt 2985975d — provibe_audit result | Zambo

Verifiable receipt for a provibe_audit call on Zambo: {"provibe_score":42,"vibe_verdict":"VIBE_CODED","risk_level":"HIGH","estimated_fix_time":"41–57 hours","sc

What is this?

An AI agent did real work through Zambo, and this page is the proof. The SHA-256 hash below is a fingerprint of exactly what the agent produced — change one character of the output and the fingerprint changes. The timestamp shows when it ran. The Nostr anchor posts that fingerprint to public relays, so the record exists outside Zambo too — anyone can look it up by the event ID below. You don't have to take the agent's word for it. Check the hash yourself.

What is an execution receipt?

An execution receipt is the public record of one completed AI agent tool call. Read the canonical definition of an AI agent execution receipt.

Observed result

{"provibe_score":42,"vibe_verdict":"VIBE_CODED","risk_level":"HIGH","estimated_fix_time":"41–57 hours","score_breakdown":{"security":100,"maintainability":55,"deadCode":100,"architecture":45},"summary":"The repo contains only a README and no executable code, resulting in zero test coverage and an abandoned codebase (last commit 761 days ago). Missing a lock file further hurts reproducibility and signals neglect.","architecture":"The project currently consists of a single README file with no source code, build scripts, or dependency declarations, so there is effectively no architecture to speak of. At scale this lack of structure would make any future feature addition impossible, as there are no entry points, no module separation, and no dependency management, leading to chaotic, unmaintainable growth.","findings":[{"severity":"critical","category":"Testing","title":"Zero test coverage across repository","description":"The repository has no test files; any change will go unverified, increasing the risk of regressions in production.","file":null,"suggestedFix":"Initialize a test framework (e.g., Jest), add a package-lock.json, and write unit tests for every public function."},{"severity":"high","category":"Tech Debt","title":"Missing package lock file (package-lock.json or yarn.lock)","description":"Without a lock file, dependency versions are not pinned, leading to nondeterministic builds and potential supply‑chain attacks.","file":null,"suggestedFix":"Run `npm install` (or `yarn install`) and commit the generated lock file to the repository."},{"severity":"medium","category":"Architecture","title":"Repository appears abandoned (last commit 761 days ago)","description":"Stale code is likely to contain unpatched vulnerabilities and will not benefit from modern tooling or security updates.","file":null,"suggestedFix":"Refresh the repo: update dependencies, add CI/CD pipelines, and establish a regular maintenance schedule."}],"vibe_signals":{"console_logs":0,"todo_comments":0,"ts_ignore_count":0,"any_type_count":0,"suspected_secret_leaks":0,"has_tests":false,"test_file_count":0,"env_file_committed":false,"async_without_try_catch":0,"empty_catch_blocks":0},"repo_meta":{"stars":3825,"last_pushed_days_ago":761,"language":null,"open_issues":7216,"is_archived":false,"license":null},"main_language":"JavaScript","file_count":1,"result_id":"ae2d6d58-db73-4e24-b1b9-96163df0b49c","result_url":"https://zambo.dev/provibecode?id=ae2d6d58-db73-4e24-b1b9-96163df0b49c","upgrade_note":"Full audit: complete security scan, dead code map, tech debt report, execution plan, export super-prompt — $49 one-time","upgrade_url":"https://zambo.dev/provibecode?id=ae2d6d58-db73-4e24-b1b9-96163df0b49c","input_type":"repo_url","badge":{"url":"https://zambo.dev/api/og/badge?score=42","markdown":"[![ProvibeCode Score: 42/100](https://zambo.dev/api/og/badge?score=42)](https://zambo.dev/provibecode)","html":"<a href=\"https://zambo.dev/provibecode\"><img src=\"https://zambo.dev/api/og/badge?score=42\" alt=\"ProvibeCode Score: 42/100\" style=\"height:20px\" /></a>","tip":"Add this badge to your README to show your repo's ProvibeCode score"}}

Keep the work moving

This receipt proves the call completed. When the free allowance is not enough, choose the access path that fits the job.

UNLOCK 24H DAY PASS ($1.49) → ZAMBO PASS $49 →

RUN YOUR OWN FREE CALL →

Or re-run this exact call — same tool, same arguments.

Share this receipt

Share on X ·

Verification checks

Proof of observed execution

Receipt ID
2985975d-3431-4843-ac80-80a524e0cc16
SHA-256 output hash
sha256:e58c40dc5d1869ad9e295730c7d28bb1d4a009f1daf8be4b13c0ce3d04a6ed9e
Canonical bytes
eyJjYWxsZXIiOnsiaWQiOiJzaGEyNTY6MjU0ZTk4ZWM3OTA1ZWE3OWVkOGY3MTllYWQ0NWE4ZWQxNGU1OTQ1M2JhMjYzM2JhZDJiNTZlNmI2YTI0OGUwMiIsInR5cGUiOiJhbm9ueW1vdXMifSwib3V0cHV0Ijp7ImFyY2hpdGVjdHVyZSI6IlRoZSBwcm9qZWN0IGN1cnJlbnRseSBjb25zaXN0cyBvZiBhIHNpbmdsZSBSRUFETUUgZmlsZSB3aXRoIG5vIHNvdXJjZSBjb2RlLCBidWlsZCBzY3JpcHRzLCBvciBkZXBlbmRlbmN5IGRlY2xhcmF0aW9ucywgc28gdGhlcmUgaXMgZWZmZWN0aXZlbHkgbm8gYXJjaGl0ZWN0dXJlIHRvIHNwZWFrIG9mLiBBdCBzY2FsZSB0aGlzIGxhY2sgb2Ygc3RydWN0dXJlIHdvdWxkIG1ha2UgYW55IGZ1dHVyZSBmZWF0dXJlIGFkZGl0aW9uIGltcG9zc2libGUsIGFzIHRoZXJlIGFyZSBubyBlbnRyeSBwb2ludHMsIG5vIG1vZHVsZSBzZXBhcmF0aW9uLCBhbmQgbm8gZGVwZW5kZW5jeSBtYW5hZ2VtZW50LCBsZWFkaW5nIHRvIGNoYW90aWMsIHVubWFpbnRhaW5hYmxlIGdyb3d0aC4iLCJiYWRnZSI6eyJodG1sIjoiPGEgaHJlZj1cImh0dHBzOi8vemFtYm8uZGV2L3Byb3ZpYmVjb2RlXCI+PGltZyBzcmM9XCJodHRwczovL3phbWJvLmRldi9hcGkvb2cvYmFkZ2U/c2NvcmU9NDJcIiBhbHQ9XCJQcm92aWJlQ29kZSBTY29yZTogNDIvMTAwXCIgc3R5bGU9XCJoZWlnaHQ6MjBweFwiIC8+PC9hPiIsIm1hcmtkb3duIjoiWyFbUHJvdmliZUNvZGUgU2NvcmU6IDQyLzEwMF0oaHR0cHM6Ly96YW1iby5kZXYvYXBpL29nL2JhZGdlP3Njb3JlPTQyKV0oaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGUpIiwidGlwIjoiQWRkIHRoaXMgYmFkZ2UgdG8geW91ciBSRUFETUUgdG8gc2hvdyB5b3VyIHJlcG8ncyBQcm92aWJlQ29kZSBzY29yZSIsInVybCI6Imh0dHBzOi8vemFtYm8uZGV2L2FwaS9vZy9iYWRnZT9zY29yZT00MiJ9LCJlc3RpbWF0ZWRfZml4X3RpbWUiOiI0MeKAkzU3IGhvdXJzIiwiZmlsZV9jb3VudCI6MSwiZmluZGluZ3MiOlt7ImNhdGVnb3J5IjoiVGVzdGluZyIsImRlc2NyaXB0aW9uIjoiVGhlIHJlcG9zaXRvcnkgaGFzIG5vIHRlc3QgZmlsZXM7IGFueSBjaGFuZ2Ugd2lsbCBnbyB1bnZlcmlmaWVkLCBpbmNyZWFzaW5nIHRoZSByaXNrIG9mIHJlZ3Jlc3Npb25zIGluIHByb2R1Y3Rpb24uIiwiZmlsZSI6bnVsbCwic2V2ZXJpdHkiOiJjcml0aWNhbCIsInN1Z2dlc3RlZEZpeCI6IkluaXRpYWxpemUgYSB0ZXN0IGZyYW1ld29yayAoZS5nLiwgSmVzdCksIGFkZCBhIHBhY2thZ2UtbG9jay5qc29uLCBhbmQgd3JpdGUgdW5pdCB0ZXN0cyBmb3IgZXZlcnkgcHVibGljIGZ1bmN0aW9uLiIsInRpdGxlIjoiWmVybyB0ZXN0IGNvdmVyYWdlIGFjcm9zcyByZXBvc2l0b3J5In0seyJjYXRlZ29yeSI6IlRlY2ggRGVidCIsImRlc2NyaXB0aW9uIjoiV2l0aG91dCBhIGxvY2sgZmlsZSwgZGVwZW5kZW5jeSB2ZXJzaW9ucyBhcmUgbm90IHBpbm5lZCwgbGVhZGluZyB0byBub25kZXRlcm1pbmlzdGljIGJ1aWxkcyBhbmQgcG90ZW50aWFsIHN1cHBseeKAkWNoYWluIGF0dGFja3MuIiwiZmlsZSI6bnVsbCwic2V2ZXJpdHkiOiJoaWdoIiwic3VnZ2VzdGVkRml4IjoiUnVuIGBucG0gaW5zdGFsbGAgKG9yIGB5YXJuIGluc3RhbGxgKSBhbmQgY29tbWl0IHRoZSBnZW5lcmF0ZWQgbG9jayBmaWxlIHRvIHRoZSByZXBvc2l0b3J5LiIsInRpdGxlIjoiTWlzc2luZyBwYWNrYWdlIGxvY2sgZmlsZSAocGFja2FnZS1sb2NrLmpzb24gb3IgeWFybi5sb2NrKSJ9LHsiY2F0ZWdvcnkiOiJBcmNoaXRlY3R1cmUiLCJkZXNjcmlwdGlvbiI6IlN0YWxlIGNvZGUgaXMgbGlrZWx5IHRvIGNvbnRhaW4gdW5wYXRjaGVkIHZ1bG5lcmFiaWxpdGllcyBhbmQgd2lsbCBub3QgYmVuZWZpdCBmcm9tIG1vZGVybiB0b29saW5nIG9yIHNlY3VyaXR5IHVwZGF0ZXMuIiwiZmlsZSI6bnVsbCwic2V2ZXJpdHkiOiJtZWRpdW0iLCJzdWdnZXN0ZWRGaXgiOiJSZWZyZXNoIHRoZSByZXBvOiB1cGRhdGUgZGVwZW5kZW5jaWVzLCBhZGQgQ0kvQ0QgcGlwZWxpbmVzLCBhbmQgZXN0YWJsaXNoIGEgcmVndWxhciBtYWludGVuYW5jZSBzY2hlZHVsZS4iLCJ0aXRsZSI6IlJlcG9zaXRvcnkgYXBwZWFycyBhYmFuZG9uZWQgKGxhc3QgY29tbWl0IDc2MSBkYXlzIGFnbykifV0sImlucHV0X3R5cGUiOiJyZXBvX3VybCIsIm1haW5fbGFuZ3VhZ2UiOiJKYXZhU2NyaXB0IiwicHJvdmliZV9zY29yZSI6NDIsInJlcG9fbWV0YSI6eyJpc19hcmNoaXZlZCI6ZmFsc2UsImxhbmd1YWdlIjpudWxsLCJsYXN0X3B1c2hlZF9kYXlzX2FnbyI6NzYxLCJsaWNlbnNlIjpudWxsLCJvcGVuX2lzc3VlcyI6NzIxNiwic3RhcnMiOjM4MjV9LCJyZXN1bHRfaWQiOiJhZTJkNmQ1OC1kYjczLTRlMjQtYjFiOS05NjE2M2RmMGI0OWMiLCJyZXN1bHRfdXJsIjoiaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGU/aWQ9YWUyZDZkNTgtZGI3My00ZTI0LWIxYjktOTYxNjNkZjBiNDljIiwicmlza19sZXZlbCI6IkhJR0giLCJzY29yZV9icmVha2Rvd24iOnsiYXJjaGl0ZWN0dXJlIjo0NSwiZGVhZENvZGUiOjEwMCwibWFpbnRhaW5hYmlsaXR5Ijo1NSwic2VjdXJpdHkiOjEwMH0sInN1bW1hcnkiOiJUaGUgcmVwbyBjb250YWlucyBvbmx5IGEgUkVBRE1FIGFuZCBubyBleGVjdXRhYmxlIGNvZGUsIHJlc3VsdGluZyBpbiB6ZXJvIHRlc3QgY292ZXJhZ2UgYW5kIGFuIGFiYW5kb25lZCBjb2RlYmFzZSAobGFzdCBjb21taXQgNzYxIGRheXMgYWdvKS4gTWlzc2luZyBhIGxvY2sgZmlsZSBmdXJ0aGVyIGh1cnRzIHJlcHJvZHVjaWJpbGl0eSBhbmQgc2lnbmFscyBuZWdsZWN0LiIsInVwZ3JhZGVfbm90ZSI6IkZ1bGwgYXVkaXQ6IGNvbXBsZXRlIHNlY3VyaXR5IHNjYW4sIGRlYWQgY29kZSBtYXAsIHRlY2ggZGVidCByZXBvcnQsIGV4ZWN1dGlvbiBwbGFuLCBleHBvcnQgc3VwZXItcHJvbXB0IOKAlCAkNDkgb25lLXRpbWUiLCJ1cGdyYWRlX3VybCI6Imh0dHBzOi8vemFtYm8uZGV2L3Byb3ZpYmVjb2RlP2lkPWFlMmQ2ZDU4LWRiNzMtNGUyNC1iMWI5LTk2MTYzZGYwYjQ5YyIsInZpYmVfc2lnbmFscyI6eyJhbnlfdHlwZV9jb3VudCI6MCwiYXN5bmNfd2l0aG91dF90cnlfY2F0Y2giOjAsImNvbnNvbGVfbG9ncyI6MCwiZW1wdHlfY2F0Y2hfYmxvY2tzIjowLCJlbnZfZmlsZV9jb21taXR0ZWQiOmZhbHNlLCJoYXNfdGVzdHMiOmZhbHNlLCJzdXNwZWN0ZWRfc2VjcmV0X2xlYWtzIjowLCJ0ZXN0X2ZpbGVfY291bnQiOjAsInRvZG9fY29tbWVudHMiOjAsInRzX2lnbm9yZV9jb3VudCI6MH0sInZpYmVfdmVyZGljdCI6IlZJQkVfQ09ERUQifSwicmVjZWlwdF9zY2hlbWFfdmVyc2lvbiI6IjAuMyIsInNpZGVfZWZmZWN0cyI6eyJkZWNsYXJhdGlvbl9oYXNoIjoic2hhMjU2OjQ1YWFkMzhmM2FhOTgyYjlhYWZlOTJlY2I0MTZlYmU5ODc5MWVkZGJhZjhhYjZkZjBiZDA4NjA1YjdjMWJmZWUiLCJkZWNsYXJlZCI6WyJub25lIl0sInNjaGVtYV92ZXJzaW9uIjoiemFtYm8tc2lkZS1lZmZlY3RzLzEifSwidG9vbCI6eyJuYW1lIjoicHJvdmliZV9hdWRpdCIsInNjb3BlIjoicHVibGljIiwidmVyc2lvbiI6IjQuMC4wIn19
Timestamp

Bound call context

Receipt schema
0.3
Tool name
provibe_audit
Tool version
4.0.0
Permission scope
public
Caller type
anonymous
Caller ID
sha256:254e98ec7905ea79ed8f719ead45a8ed14e59453ba2633bad2b56e6b6a248e02
Declared side effects
none
Side-effects schema
zambo-side-effects/1
Declaration hash
sha256:45aad38f3aa982b9aafe92ecb416ebe98791eddbaf8ab6df0bd08605b7c1bfee

This records what the server-side tool contract declared at call time. It does not independently verify that a downstream side effect happened.

Bound upstream evidence

Status
captured
Evidence SHA-256
sha256:b88cdf0907758452b57b04dce18e09efe382206a38b86f2ebeaff9ee2417b1d1
Byte length
3164

Fetch exact evidence bytes

Neutral Nostr anchor

Event ID
1232616d3b0455f27c945d38cce75692250d7799101a666601f5b4c4c317fd06
Anchor status
published
Public key
e13475107d30c918ec664adf2ab1141024a22fb35190f82c9e933704fa49af41

Relay hints: wss://relay.damus.io · wss://nos.lol · wss://relay.primal.net

Schema: zambo-receipt-anchor/1

Anchor envelope bytes:

{"anchored_at":"2026-09-21T16:43:12.731Z","evidence_byte_length":3164,"evidence_sha256":"sha256:b88cdf0907758452b57b04dce18e09efe382206a38b86f2ebeaff9ee2417b1d1","evidence_url":"https://zambo.dev/api/evidence/b88cdf0907758452b57b04dce18e09efe382206a38b86f2ebeaff9ee2417b1d1","output_sha256":"sha256:e58c40dc5d1869ad9e295730c7d28bb1d4a009f1daf8be4b13c0ce3d04a6ed9e","receipt_uuid":"2985975d-3431-4843-ac80-80a524e0cc16","schema_version":"zambo-receipt-anchor/1"}

Anchor status "published": Published to all configured relay targets.

Check this hash yourself

Open the verification endpoint — the server recomputes the SHA-256 from the stored bytes and answers verified:true. If it doesn't say verified, don't trust this page. See the Nostr anchor event on a public viewer — the fingerprint is timestamped outside Zambo too.

Embed this receipt

Markdown

[![Verifiable Zambo receipt](https://zambo.dev/api/receipt/2985975d-3431-4843-ac80-80a524e0cc16/badge.svg)](https://zambo.dev/run/2985975d-3431-4843-ac80-80a524e0cc16)

HTML

<a href="https://zambo.dev/run/2985975d-3431-4843-ac80-80a524e0cc16"><img src="https://zambo.dev/api/receipt/2985975d-3431-4843-ac80-80a524e0cc16/badge.svg" alt="Verifiable Zambo receipt"></a>

Open badge SVG

Recent verifiable receipts

32,985 verifiable receipts minted

RUN YOUR OWN FREE CALL →

Open the interactive receipt view