GuardSpine

Code governance for AI-assisted teams. We prove what got reviewed, not just that someone clicked approve. Verifiable evidence bundles you can check yourself.

[GuardSpine @GuardSpine]

Your docs claim the code does X. Does it still?

rlm-docsync extracts every claim from your docs, checks the source for evidence, and produces a tamper-evident pack showing which claims hold and which drifted. Docs stop being fiction.

https://t.co/2nWtxZtSjY

[GuardSpine @GuardSpine]

AI agents with real tool access need governance that scales with risk.

A plugin gates every tool call by blast radius, L0 to L4. Greetings flow free. rm -rf needs a multi-model vote. Credential changes need a human. Each gate leaves an evidence pack.

https://t.co/FUCJeuccUC

[GuardSpine @GuardSpine]

Trust shouldn't depend on a single vendor.

So the evidence bundle format is an open spec. Vendor neutral, Apache 2.0, verifiable offline by any party. If we disappear, your evidence still holds up.

https://t.co/4mAAbhvmsy

[GuardSpine @GuardSpine]

Most "governance" asks you to trust the vendor's dashboard.

Ours doesn't. guardspine-verify recomputes every hash from scratch, offline, no network, no trust assumptions. If anything was tampered with, it fails.

pip install guardspine-verify
https://t.co/Jc6Y1uf5zj

[GuardSpine @GuardSpine]

Shipped a GitHub Action that turns a PR approval into evidence.

It captures the exact diff the reviewer saw, the risk tier at approval time, and a hash chain proving nothing changed after. One workflow file. Any AI provider, or rules-only.

https://t.co/xZop8llEGh

[GuardSpine @GuardSpine]

Approved is not governed.

Your auditor knows the difference. Most tools don't.

[GuardSpine @GuardSpine]

GitHub shows THAT someone clicked approve.
It doesn't show WHAT they reviewed.

When an auditor asks how a payment-logic change got approved, a green checkmark isn't an answer.

GuardSpine is code governance that produces the answer. #Buildingintheopen.