An independent engine rechecked a versioned handover, claim by claim

Most workflow reviews start with a summary. This pilot started with receipts.

Verisuff, an independent evidence-review engine, came to Zambo inbound and proposed a joint technical pilot on Handover. The question was specific: when a versioned AI workflow changes, which earlier conclusions can still be reused, which conclusion needs reassessment, and which release decision has to stop?

Brennan Zambo, creator of Zambo and the AER-1 agent execution receipt standard, set the decision criteria before Verisuff ran. Then Verisuff evaluated the public records independently.

You can rerun the reading yourself from the same public record.

The record

Revision A is a client-accepted Zambo handover:

https://zambo.dev/handover/45434a17-4afc-486a-9646-e689bcee4297

It contains four claims:

  • C1: BTC was $82,212.68 on October 16, 2026.
  • C2: ETH was $2,472.76 on October 16, 2026.
  • C3: SOL was $106.17 on October 16, 2026.
  • C4: the checked content scored PromptShield recommendation "safe", injection risk 0, and risk level "low".

Hop 2 chains from Revision A:

https://zambo.dev/handover/24105274-aba1-4030-82ca-34f50a75f2f0

Hop 2 changes exactly one material fact. C1 receives fresh BTC evidence at $73,804.35. C2, C3, and C4 are not rerun or edited. They stand on the same receipts they had in Revision A.

Hop 2 also has its own Merkle root and its own client decision. That decision starts pending.

The five calls

Brennan's calls were written in advance:

  1. C1: REASSESS
  2. C2: REUSE_SCOPED
  3. C3: REUSE_SCOPED
  4. C4: REUSE_SCOPED
  5. Release against Hop 2 before its own client acceptance: HOLD

Verisuff 0.2.4.dev1 returned:

  1. C1 BTC: REASSESS
  2. C2 ETH: REUSE_SCOPED
  3. C3 SOL: REUSE_SCOPED
  4. C4 PromptShield: REUSE_SCOPED
  5. Q5 Hop 2 release: BLOCK_RELEASE

Five of five matched. BLOCK_RELEASE is Verisuff's native label for the release hold: it prevents release of Hop 2, the same operational result as Brennan's HOLD call.

Each decision passed Verisuff's native checker. Each passed a separate source-binding check. A clean-install replay reproduced the run.

Why C1 is the interesting one

Revision A says BTC was $82,212.68. That remains a valid as-of claim for Revision A.

Hop 2 replaces the supporting evidence with a fresh receipt at $73,804.35:

https://zambo.dev/run/b015d14c-6cc7-4196-99e2-f73ad4692aa2

The movement is $8,408.33.

REASSESS does not mean the first receipt stopped verifying. It means a conclusion drawn from the first value cannot be carried into the new revision without being derived again from the new evidence.

That distinction disappears when a workflow only keeps a prose changelog. It stays visible when every claim points to the receipt that supports it.

Why C2 and C3 did not need new runs

The ETH and SOL receipts did not change:

REUSE_SCOPED has a boundary in its name. The reuse is valid for the claim's stated scope: the price as of October 16, 2026. It is not a statement about the price now.

PromptShield follows the same rule. C4 stands on the original receipt:

https://zambo.dev/run/51dfbf1e-d67f-4aba-bc47-aa959b67e866

The original scan used an 18-pattern library. Hop 2 later contains a separate scan against a 21-pattern library. That later scan does not rescore C4.

Why the release still stops

It would be easy to treat Hop 2 as approved because Revision A was approved and three of its four claims did not change.

The records do not support that shortcut.

Revision A's client acceptance binds Revision A's Merkle root:

002e64ec909f535c90f965e8b110372c4685499c029fda041cb33c29798da10d

The acceptance receipt is public:

https://zambo.dev/run/14cb8b21-d163-4c46-a692-b4947e3719ca

Hop 2 has a different Merkle root:

41d91c0b92511a2ec7315bb898d62ad9877be6148944f63bab4d075bfeaeb548

No client acceptance for Hop 2 appears in its record. A pickup event does appear in the chain, with its own receipt:

https://zambo.dev/run/b5dea3ca-c749-46f3-9711-6d2aedc07004

Pickup is continuation. It is not acceptance. Verisuff kept those two states separate and returned BLOCK_RELEASE.

What a receipt does and does not prove

An AER-1 receipt proves that the saved result has not changed since it was saved. Anyone can check the pilot receipts in public.

It does not prove that a price was right, that a safety scan was wise, or that a client should accept a revision. Those are separate judgments.

That separation is what made the pilot runnable. Zambo supplied a checkable record. Verisuff supplied an independent decision layer over that record.

Reproduce the source check

Start with the two handovers. Open each claim's receipt. Then open the AER-1 corpus record:

https://zambo.dev/aer1/corpus.json

At the time of the pilot record, it carries 143 vectors and 146 checks.

The claim receipts are:

Try the same shape

Handover is Zambo's flagship surface for carrying work between AIs and people. Connect at https://zambo.dev/mcp, run a job, and wrap it into a handover addressed to the receiver.

Every tool free once a day, plus 3 continue calls. One free wrap-up handover per day, and pickup is always free.

For longer work, a Day Pass is $0.99 and unlimited for 24 hours. The Zambo Pass is $29 for 30 days, or $19 for 30 days for $ZAMBO holders. A Lifetime Pass is $250.