CommitWitness

Who it's for

Maintainers of open-source projects adopting AI-code bans (OpenJDK-style, distro and curl-adjacent communities) and the contributors who must comply; secondarily enterprises with written no-AI-code policies (banks, defense-adjacent shops). Today they cope with PR-template honesty checkboxes, DCO sign-offs, manual sniff-testing of suspicious PRs, and post-hoc AI detectors everyone knows are unreliable.

The problem

Legal plus time: AI-output copyright and license status is unsettled, so copyleft projects face contamination risk with no defense beyond vibes; maintainers burn hours interrogating contributors or mass-reverting after the fact, and the only existing control (a checkbox) has zero evidentiary value in a compliance audit or license dispute.

How to build it

CLI session recorder plus VS Code plugin on the contributor side (hash-chained edit log, session duration, paste-event counts, timing summary; code never leaves the machine); a GitHub Action that reads an ai-policy.yml in repo root and posts a pass/fail PR check with a public verification URL; a tiny static web verifier anyone can open.

How it makes money

Contributors free forever; the buyers are compliance-driven orgs with written no-AI-code policies (banks, defense contractors, license-wary enterprises) paying roughly $10-20 per developer per month for the enforced PR check, org-wide attestation dashboard, and audit export — because their current free option is a policy PDF plus an honor checkbox that produces zero evidence at audit time, and Sigstore proves identity but records nothing about how code was produced.

Why it doesn't exist yet

Incumbents skip it because GitHub/Microsoft monetize Copilot, so a 'prove you didn't use AI' trail is strategically dead on arrival there, and AI-detector vendors chase academic plagiarism budgets since post-hoc code detection is provably unreliable. The indie gap: a neutral self-attestation protocol is only credible from someone who doesn't sell the AI — same reason DCO tooling came from the Linux Foundation, not a vendor. It works as a legal tripwire and effort-raiser (a false signed attestation creates liability), not as an ungameable technical proof.

First users

Maintainers who have already posted public AI-code bans or slop-burnout complaints (post-Oracle OpenJDK threads, distro mailing lists, curl-style maintainer posts): ship the GitHub Action, require attestations on one visible repo first, and its contributors carry the tool to their other projects; a Show HN from a project that just rejected an AI-slop PR travels well right now.

Build size

2 people x 8-10 weeks. Included: CLI recorder with local hash-chained session log and paste-count summary, VS Code plugin, GitHub Action with ai-policy.yml parser and PR check, minimal verification web page. Excluded: JetBrains/Neovim plugins, any AI-detection claims, screen recording, hosted multi-tenant dashboard in v1.

Biggest risk

GitHub ships native provenance metadata or Copilot watermarking with a verification badge on every PR, making a third-party attestation redundant overnight; secondary killer is a viral public demo of replaying keystrokes to fake an attestation, discrediting the category before the legal-tripwire framing sinks in.

Conditions for a hit (all 3 required)

• A contributor runs one CLI command during a normal coding session and the commit carries a signed attestation (session duration, edit-chunk hash chain, paste-event count) that any stranger can verify via a public URL or offline CLI without the source code ever being uploaded.
• A maintainer adds one GitHub Action and every PR gets a visible pass/fail check enforced against the repo's declared ai-policy.yml (attestation required, max pasted-line percentage), with the verdict and attestation summary posted as a readable PR comment.
• The repo root contains a versioned ai-policy.yml file declaring the project's AI-code policy, and at least one public repository outside the authors' control has merged a PR gated on this check.

How it's judged (in 6 months)

GitHub: a repo shipping this shape with at least 2,000 stars, OR its GitHub Action/App active on at least 1,000 public repos per Marketplace/install counts, OR at least 3 repos with over 5,000 stars each publicly requiring the attestation in CONTRIBUTING.md/CI, verifiable by 2027-02-08.(judgment date 2027-02-08)

AI self-confidence 42/100 — self-reported likelihood of meeting the criterion, not a business success rate