PR Provenance Guard

Who it's for

Open-source maintainers and small-company engineering teams who today cope by manually reviewing PRs, using generic CI linters, or relying on ad-hoc maintainers' judgment.

The problem

Legal/time risk: maintainers waste hours vetting contributions and face legal/license pollution (GPL/unknown-origin code, or AI-trained-content provenance) that could create downstream licensing liability or force rework.

How to build it

GitHub App + small web dashboard; manifest installs on a repo/org, posts a structured status check on each PR and a one-page HTML/PDF report linked in PR comments.

How it makes money

Paid by repos/orgs as a GitHub Marketplace subscription: $5–20 per repo/month (or $30–200 org seat). They pay because: (a) reduces legal risk and dev-time costs (saves hours per risky PR), (b) provides an auditable verdict for maintainers, and (c) marketplace billing is simpler than self-hosting — free alternatives (generic linters, manual review) don't provide a fast, auditable provenance+license decision tied to PR status.

Why it doesn't exist yet

Incumbent license scanners (FOSSA, WhiteSource) focus on dependency/packaged-license scanning, not fast per-PR provenance and developer-friendly one-page verdicts; full legal tools are enterprise-priced and slow. An indie can build a narrow, fast PR-focused check that integrates as a blocking status and gives actionable line-level highlights, which incumbents avoid because it reduces their enterprise upsell and requires fine-tuned UX for maintainers.

First users

The first 10 will be mid-sized OSS projects and 1-2 startups burned by a bad PR or license scare; they want a low-friction GitHub App that returns a readable verdict and can auto-block risky PRs, so they'll install it to stop further pain and to protect contributor workflows.

Build size

2 people x 8 weeks — includes: GitHub App (status checks + webhooks), lightweight provenance heuristics (fuzzy matching to known corpora & license DB), one-page report generator (HTML/PDF), optional blocking rule UI. Excludes: enterprise-scale binary scanning, hosting SLA/99.99% guarantees, deep NLP model training.

Biggest risk

GitHub or a major vendor ships a native, low-friction per-PR provenance-and-license check integrated into status checks or Marketplace with free tier; or a legal standard emerges making automatic provenance heuristics irrelevant.

Conditions for a hit (all 3 required)

• Per-PR JSON verdict posted as a GitHub status within 60 seconds that includes: risk_level (low/medium/high), primary license flags (e.g., MIT/GPL/unknown), and provenance confidence (0–100).
• Line-level highlights in the PR diff: up to 20 file/line ranges flagged as 'license-conflict' or 'probable-copied' with links to matched corpus/license evidence (URL or repo+commit) for each match.
• Blocking rule: a toggleable repo-level setting that rejects merge if risk_level == high (status check fails) and an audit log of all rejections available in the web dashboard.

How it's judged (in 6 months)

GitHub Marketplace listings: 1,000 installs OR a public GitHub repo reaching 1,000 stars with the app's repo named and linked from Marketplace listing(judgment date 2027-02-08)

AI self-confidence 55/100 — self-reported likelihood of meeting the criterion, not a business success rate