Skip to content

PatchWitness v0.1.0 - Proof before merge

Choose a tag to compare

View all tags
@pangxueyuan2-creator pangxueyuan2-creator released this 11 Aug 07:10
· 127 commits to main since this release
v0.1.0
9bce7d2

PatchWitness v0.1.0 - Proof before merge

The first public release introduces an independent trust layer for AI-generated code changes.

This release was materially accelerated by OpenAI Codex in ChatGPT. Its ability to understand a
repository, implement features, run tests, inspect failures, and iterate across engineering and
documentation work made it possible to develop PatchWitness as a coherent platform rather than a
thin demo. That experience reinforces the project's premise: powerful coding agents and strong,
independent verification are complementary parts of the same future.

Try the real risk demo

git clone https://github.com/pangxueyuan2-creator/patchwitness.git
cd patchwitness
python demo/run_demo.py

Install the release wheel with pipx:

pipx install "https://github.com/pangxueyuan2-creator/patchwitness/releases/download/v0.1.0/patchwitness-0.1.0-py3-none-any.whl"

Highlights

  • Launch companion demo on main: a correct, test-passing feature is blocked because the agent also makes CI
    failures non-blocking; the exact terminal transcript and verified Change Passport are committed.
  • Base-authoritative contracts: load policy from an immutable trusted Git SHA so a PR cannot
    weaken its own gate.
  • Portable Change Passports: offline-verifiable JSON plus Markdown, SARIF, and GitHub output.
  • Real verification evidence: command exit codes, timing, redacted excerpts, and output hashes.
  • Impact-aware review: cached Python/JavaScript/TypeScript downstream dependency analysis.
  • Safer execution: disposable hook-disabled clean-room worktrees and high-confidence secret
    findings that never retain the value.
  • Platform surface: CLI, Python SDK, analyzer plugins, stdio MCP tools, Docker, and a composite
    GitHub Action.

Validation

  • The v0.1.0 artifacts passed the original 27-test suite; current main adds an end-to-end
    reproduction of the public risk demo for 28 tests total.
  • Ruff and strict mypy pass.
  • Real package build and wheel smoke test.
  • Windows benchmark raw data is committed under benchmarks/results/.

Important limitations

This is a public alpha. Clean-room worktrees are not a kernel sandbox, SHA-256 does not authenticate
producer identity, and passing checks do not prove semantic correctness. Read SECURITY.md,
PROJECT_STATUS.md, and docs/threat-model.md before high-assurance deployment.

PatchWitness is independent and is not affiliated with or endorsed by OpenAI.

Assets 4
Loading