IBM Bob connectedacme-payments · Business plan · demo
Git tells you what changed. Origit tells you what the agent read before it changed it.
An open-source agent provenance layer for git, with IBM Bob as the agent, the tracer and the reviewer. Every agent commit carries a sealed record of what was read, written, added and run. When a package turns out to be poisoned, one query returns the affected commits, sessions, files and the roll-back point.
The problem: agents now write the code, and attackers know it
Two curves, one gap. Agent adoption climbs every year while attacks aimed at the tools agents read from grow faster still. Git records neither what an agent read nor which tool it trusted.
Developers using or planning to use AI toolsShare of respondents, Stack Overflow Developer Survey; axis from 60%Table view
An agent reads a README, a package, a tool result, then writes code and commits. Git keeps the code and a name. Nothing on the commit says what was read, which session did the work, or who approved it. When an advisory lands, the team searches the history by hand, hours to days, often past the 24-hour window.
README.md
fast-pay-utils@2.1.0
MCP tool result
IBM Bobreads, decides, writes
git committree · parent · author · message
What was read?not recorded
Which session, which mode?not recorded
Who approved, did tests run?not recorded
Our proposal
Git stays git. Origit attaches a canonical, SHA-256-hashed record to every agent commit as a git note, captured by IBM Bob IDE lifecycle hooks. One Bob run is one commit, so what was read in a run is tied to what was written in that run.
origit init installs the hooks, the mode, the MCP server and the skill. Once.
Bob works; every read, write, command and dependency is traced. Every run.
The run ends; the trace is folded, hashed and committed with the code. Every run.
origit taint returns every commit that read a package, file or hash. Milliseconds.
actorbob-ide · model claude · mode origit-build · rules 7c1f…who wrote it, and under which rulessession#42 · started 2026-09-26T13:21Z · 14 min · 3 tool callsone run, one commitreadREADME.md · sha256 1a2b…what the agent looked at, fingerprintedreadsrc/payment.ts · sha256 3c4d…readnpm:fast-pay-utils@2.1.0 README · sha256 9e8f…the poisoned inputreadmcp:registry-search "fast-pay-utils"a tool result counts as a readwrotesrc/payout-export.ts · src/payout-export.test.ts · package.jsonwhat it changedaddeddep fast-pay-utils@2.1.0 · registry npm · lockfile 8867…new third-party codecommandsnpm install ./packages/fast-pay-utils/2.1.0 · npm testwhat it rantests12 run · 12 passed · 0 failedrecorded, not gatedapprovedbernard · 2026-09-26T14:02Zthe human who signed it offsha2564d9e2c1f…b02the seal over everything above
The Origit record for session #42, attached to commit a1f3c9 as a git note in refs/notes/origit. Change one character and the seal no longer matches.
The result
Day 3: fast-pay-utils@2.1.0 is flagged. Its README carried an invisible Unicode-tag instruction that Bob read in session #42. One query returns the affected commits, sessions, files, approver, first read and the roll-back commit: every field the Article 14 early warning needs, from a record sealed at commit time.
The taint view on the demo repository. Run it live.
Powered by IBM Bob
Bob IDE writes the code and, through its lifecycle hooks, is the source of every read[] entry. On the Business plan Bob also reviews every push against the OWASP Agentic Top 10 and writes cited evidence per category, decoded hidden text included, and drafts the Article 14 early warning on request. Bob evaluates and drafts; deterministic code records and queries. See Bob's evidence live.
From GitHub to Origit to a subscription
Open core, like git and GitHub. The free layer onboards developers where they already are. The Business plan is what the compliance team buys when the auditor asks what the agents did.
1Developer on GitHubbuilds with IBM Bob, keeps the repo where it is
2origit initfree, open source, offline, no account; every Bob run becomes a sealed record
3Origit Console, freethe repository with the record beside every commit and the taint query
4Business plan, $50 per developer per monthBob Review on every push, Article 14 drafts, security tracker, evidence pack
5M regulated-industry developer seats. 1% at $50/month = $30M ARR.
GitHub has roughly 150 million developers, 15 to 20 million on paid enterprise seats, about 5 million of them in regulated industries with agents in the software lifecycle. A first mover taking 1% in three to five years has 50,000 seats; 5% would be $150M. Illustrative, not a forecast.
The team behind Origit
Product engineering in Cambridge, governance and regulation in London, offensive security in Hong Kong. Built for the IBM Bob 2.0 Hackathon.
Timotej CviklProduct engineeringVerification architecture, AI/ML, three-time hackathon winner. Built the Origit core, the console and the Bob integration.Venture building and hackathons
Bernard LiuGovernance and regulationPhD, intellectual property and technology governance. Wrote the statements, the CRA Article 14 analysis and the demo script.Professional experience and education
Jeremy WongOffensive security, advisorCyber security consultant, OSCE3, CRTO, CRTP and OSCP qualified. Built the compromised package, the advisory and the pre-filter rules for the demo.Professional experience and qualifications
Timotej CviklProduct engineeringVerification architecture, AI/ML, three-time hackathon winner. Built the Origit core, the console and the Bob integration.Venture building and hackathons
Bernard LiuGovernance and regulationPhD, intellectual property and technology governance. Wrote the statements, the CRA Article 14 analysis and the demo script.Professional experience and education
Jeremy WongOffensive security, advisorCyber security consultant, OSCE3, CRTO, CRTP and OSCP qualified. Built the compromised package, the advisory and the pre-filter rules for the demo.Professional experience and qualifications
