AI writes the code.
We produce the proof.

1. The verification gap is now the bottleneck

Agents write production code faster than any team can review it by hand. The speed is real and it isn't going back in the box. What hasn't kept pace is the answer to the question every auditor, board, and enterprise customer eventually asks: who, other than the thing that wrote this change, verified it — and where's the record?

2. "The author grades its own homework" is the default — and it fails the room

The industry's reflex is to fold verification inside the coding agent: the same platform that writes the diff also reviews it, governs it, and logs it. That is the author grading its own homework with extra steps. Access policies and session logs are governance; a recording of an agent working is a demo. Neither is an independent verification of the change, bound to the change. When a regulator or a customer's security team asks for separation of duties, "our platform reviewed itself" is not the answer that survives the room.

3. Independent AI change control

Put the verification layer above the agents and make it answer to no single vendor — including us, including the models you already use. Concretely, and checkable today on our own repositories:

• Separation of duties. The authoring model never grades its own diff. A quorum of rival-vendor models reviews it; when priors that disagree still converge on "safe," that agreement means something one model's verdict cannot.
• Evidence bound to the commit. Every verdict is written to a per-SHA artifact tied to a diff hash. Amend the commit and the binding breaks. The verdict is a function of the code, not of who ran it or when — and it replays.
• Deterministic decisions. Non-determinism stays in the models; the gate decision is produced by fixed rules, in an authoritative aggregation kernel.
• Loud, audited exceptions. Overriding the gate takes a structured, allowlisted, append-only reason. There is no quiet bypass. Strictness everywhere else is what that buys.

4. What we claim, and what we don't

A company selling verification has no business overselling itself. So we're precise: the four tenets above are shipped and dogfooded. Independent, cryptographically signed attestation — the capstone that lets you verify a verdict offline — is not yet shipped, and we say so plainly until it is. We are behind on code generation by choice; we don't author, and the proliferation of agents that do is our tailwind. And we refuse the category next door — "AI code review" — because a comment is not a control, and that layer is bundling to zero. We publish the full ledger, gaps included, on our trust page.

5. The proof is a file, not a story

The whole thesis collapses to one demo: pick any merged change, and here is its complete evidence — the rival-vendor findings, the deterministic decision, the diff it's bound to. We've run that gate on thousands of our own AI-authored changes before asking anyone to run it on theirs. The receipts are counts and method, never your code. That's the point: proving a change was governed should never require exposing the change.