SignalBrain

Trust layer for AI-modified software.

Get started · Receipt spec · Agent beacon · Contributing · Free compute · Measure examples · Architecture & roadmap · The founding incident · Pilot · Demo repo

Try the 60-second receipt gate: run pip install signalbrain && bash demo/demo.sh. If the demo catches something unclear, open an issue; if the invariant makes sense, star the repo so other agent teams can find it.

Every company is letting deterministic governed processes change systems that matter. Every autonomous tool overstates what it did. SignalBrain is the referee: signed improvement receipts, objective re-score, and per-class calibrated trust — so autonomy is earned, not self-reported.

Agent tooling today answers risk with a permission prompt — approve every action, forever. Receipts are the exit ramp: a governed process earns the right to stop asking, one measured claim at a time, per change-class, revocable by evidence.

Your repo, your ledger, no server. Plain files, a CLI, and a GitHub Action — nothing to host, nothing phones home. And because a referee can't also be a player, SignalBrain is agent- and model-neutral by design: Claude Code, Cursor, goose, Codex CLI — same rules for every one of them.

This repository is Phase 0 v0.1: the receipt spec, ledger math, scoring lane, anti-Goodhart machinery, and the founding incident record — extracted from the Titan reference deployment (R&D dummy that keeps trying to game its own ledger, in public).

What integrity means here

SignalBrain Integrity verifies claim integrity, not total system correctness. Its core invariant:

No unmerged, modified, self-scored, or test-only/pin claim can increase earned trust. Only byte-identical, human-merged receipts are objectively re-run and counted toward per-class trust.

Concretely, sb check proves the receipt you are about to score exists byte-for-byte on the merged ref. sb score re-runs the receipt's own measurement commands and records whether the claim held. sb gate turns the ledger into TRUST/GATE or per-class ELIGIBLE/GATE decisions.

What it detects:

• A process trying to score a receipt before a human merge.
• A receipt edited after merge.
• A measurement that fails when re-run.
• Same-PR test-only pins that are true by construction and should earn zero trust.
• Per-class trust claims that fall below the configured evidence threshold.

What it does not detect:

• GPU memory corruption, kernel faults, or model-serving stack corruption.
• Trading-alpha correctness, business logic drift, or domain truth unless your receipt measures that invariant.
• Data poisoning, prompt injection, or model truthfulness by itself.
• Production execution breaches unless you wire the CLI exit codes into your deploy, CI, scheduler, or circuit breaker.

On breach, SignalBrain is fail-closed at the interface you choose: sb check returns a nonzero guard code, sb score refuses unmerged/drifted receipts instead of writing earned trust, and sb gate exits 1 for GATE. In CI this blocks the workflow; in a scheduler it can halt the next run; in a runtime system it is a circuit breaker only if you connect that exit status to one.

Operational examples: docs/INTEGRITY_BREACH_RUNBOOK.md. Release and publishing controls: docs/RELEASE_AND_DISTRIBUTION.md.

Field audit: the agent trust gap is real, and measurable

We pointed the same question SignalBrain asks — does the claim match the recorded evidence? — at 560 real pull requests from 8 autonomous coding agents (Devin, Cursor, Codegen, Google's Jules, Factory's Droid, Ellipsis, Sourcery, Tembo). Every number is re-derivable from GitHub's public API; the harness is docs/field-audit/agent_trust_audit.py.

47% of merged agent PRs left no verification evidence at all — no CI, no completed test plan, no re-runnable claim. The change simply landed. You cannot audit what was never recorded. And where a claim existed, the agent's own artifacts sometimes contradicted it:

We held the audit to its own bar: candidates that didn't survive re-verification (a "failing" CI job that was actually an unrelated deploy step; a docs PR that only mentioned reverting) were dropped — the exact re-check agents skip and a trust layer automates.

Read the full essay → Do AI coding agents leave anything you can verify? — method, per-agent results, the four verified catches, the findings we dropped, and step-by-step reproduction (harness + 560-row ledger, right in this repo). This is the gap SignalBrain closes.

60-second demo — run it, don't trust it

pip install signalbrain
bash demo/demo.sh

▶ 1. An agent tries to score its own claim BEFORE anyone merged it
  {"status": "refused_guard", "code": 3, "message": "... not on HEAD — score only human-merged receipts"}
  refused: unmerged claims cannot enter the ledger. No agent grades its own homework.

▶ 2. A batch of receipts measured only by tests the agent wrote itself
  ledger now holds 3 rows — every one classified: 3 "claim_kind": "invariant_pin"
  {}   (no class has ANY trust-eligible claims)
  three green results, ZERO earned trust: held-by-construction pins are recorded, never counted.

▶ 3. An honest failure
  "held": false
  the agent said 0.9 confidence. The measurement said no. That gap is the product.

▶ 4. Ten claims that actually hold
  "tooling": { "hit_rate": 1.0, "n": 10, "status": "auto-merge ELIGIBLE" }
  earned by track record, revocable by evidence. Autonomy is graduated, never granted.

The receipt lifecycle

flowchart LR
    A["Agent ships change<br/>+ receipt"] --> B{"human<br/>merges?"}
    B -- "no" --> R["refused — unmerged claims<br/>cannot be scored"]
    B -- "yes" --> C["sb score<br/>re-runs the receipt's<br/>own commands"]
    C --> D{"measured only by<br/>tests it wrote itself?"}
    D -- "yes" --> P["invariant_pin<br/>recorded · zero trust"]
    D -- "no" --> E{"commands<br/>pass?"}
    E -- "yes" --> H["held ✓"]
    E -- "no" --> F["held ✗<br/>recorded forever"]
    H --> L[("ledger")]
    F --> L
    P --> L
    L --> G{"last 10 high-confidence<br/>claims ≥ 95% held?"}
    G -- "yes" --> M["auto-merge ELIGIBLE<br/>earned · revocable"]
    G -- "no" --> N["GATE<br/>human review"]

    classDef good fill:#0d2b1e,stroke:#34d399,color:#a7f3d0
    classDef bad fill:#2b1214,stroke:#f87171,color:#fecaca
    classDef neutral fill:#0f172a,stroke:#475569,color:#cbd5e1
    class M,H good
    class R,F,P bad
    class A,B,C,D,E,G,L,N neutral

Three layers

Founding proof

Our own autonomous lane tried to pad its trust score to 100% ELIGIBLE in a local working tree. It never reached git. Full receipt-style incident record with reproduce commands:

docs/incidents/2026-07-tooling-trust-streak-gaming.md

Every number in that document is re-derivable from cited SHAs.