PR Receipts

warden is a local flight recorder for AI-written code changes. It wraps an agent, shell, package manager, or test command; records what changed; checks policy evidence; and emits a compact PR receipt that reviewers can verify before merging.

warden init
warden doctor
warden run -- codex
warden receipt
warden history
warden github-comment --dry-run

Example receipt:

PR Receipt
Tool: warden 1.0.0
Agent: Codex
Files changed: 7
Tests run: passed
Secrets: macOS sandbox enforced, no canary leaks
Network: allow, not observed
Dependencies changed: no
Risk score: low
Reproducible replay: yes
Verification: sha256 OK

Why this exists

AI agents can change code faster than reviewers can reconstruct the run. PR Receipts give a reviewer a small, inspectable record of:

• which command produced the change
• which files changed
• whether dependency manifests or lockfiles changed
• whether a test-like command was detected and passed
• whether injected canary secrets leaked into output or changed files
• whether a local sandbox backend was enforced
• whether the receipt body still matches its SHA-256 seal

The goal is not to make AI-generated code automatically safe. The goal is to make the review boundary explicit and harder to hand-wave.

Install

After the repository is public, install the CLI directly from GitHub:

cargo install --git https://github.com/devchilles/PR-Receipt --locked

For local development:

git clone https://github.com/devchilles/PR-Receipt.git
cd PR-Receipt
cargo test
cargo run -- doctor --sandbox off

Commands

warden init [--path warden-policy.json] [--force] [--no-gitignore]
warden doctor [--policy warden-policy.json] [--sandbox auto|off|enforce] [--network allow|deny]
warden run [--agent Codex] [--policy warden-policy.json] -- <command> [args...]
warden receipt [--path .warden/last-receipt.json] [--format text|markdown|json]
warden history [--receipt-dir .warden] [--limit 10] [--format text|json]
warden github-comment [--path .warden/last-receipt.json] [--pr 123] [--dry-run]

Policy file

warden init creates a starter policy:

{
  "sandbox": "auto",
  "network": "allow",
  "secret_paths": ["~/.aws", "~/.ssh", ".env", ".env.local"]
}

Use "network": "deny" on macOS to ask the sandbox profile to block inbound and outbound network access.

What v1 verifies

• Creates a starter warden-policy.json and ignores local receipt bundles with warden init.
• Checks local readiness, effective policy, Git state, and sandbox enforcement with warden doctor.
• Runs an agent or shell command under warden run -- ....
• Captures before/after Git state and changed files.
• Writes a replay bundle under .warden/receipts/<session>/.
• Records Warden version, effective policy, sandbox provider or observe-only reason, and the wrapped command.
• Detects dependency manifest and lockfile changes.
• Detects whether the wrapped command looked like a test command and whether it passed.
• Injects non-sensitive canary values and checks command output plus changed files for leaks.
• On macOS, uses sandbox-exec to deny reads and writes to common secret paths such as ~/.aws, ~/.ssh, and repo .env files.
• Seals the receipt with a SHA-256 digest over the receipt body.
• Renders text, JSON, and GitHub-ready Markdown receipt summaries.
• Lists recent receipt history with verification status via warden history.

Limits

The receipt is deliberately explicit about gaps. Network egress is marked as not observed unless a platform backend records it. Linux currently runs in observe-only mode unless a sandbox backend is added. A receipt is review evidence, not a replacement for code review, threat modeling, or CI.

Development

cargo fmt --all -- --check
cargo clippy --all-targets --all-features -- -D warnings
cargo test --locked --all-targets --all-features
cargo package --locked --list

See CONTRIBUTING.md for contribution guidelines and SECURITY.md for vulnerability reporting.