TREFT
After the incident

The 90-day reset.

For the engineering leader in the week after an AI-attributed incident — when “every agent change needs human sign-off and proof” becomes policy, and the proof is suddenly manual.

The pattern

An incident lands, and the retro attributes it to an agent-authored change that nobody fully read. What follows has the same shape everywhere: a freeze, then a mandate — for the next quarter, every agent change needs a human sign-off and evidence that it was actually checked.

The mandate is right. The way it usually gets implemented is not: screenshots pasted into tickets, review-by-spreadsheet, a senior engineer re-running test suites by hand to prove what CI already claimed. The policy is sound; the tooling is a person. Ninety days of that burns exactly the people the mandate was written to protect — and when it lapses, nothing structural remains.

The policy, productized

Treft is that mandate as a product. Each clause of the reset maps to a mechanism that already runs:

  • “Independently checked” — every change is re-verified from a fresh checkout on a separate machine: exact patch, network cut, your own test suite, an environment the agent never touched.
  • “With evidence” — each verification carries a grade naming exactly what was established, in plain words. Unverified is explicit — never a fake green.
  • “Enforced, not requested” — Treft posts a Treft Verification check on every pull request it verifies. Mark it required in branch protection and GitHub blocks the merge while the check runs and when the clean-room run comes back red. It does not yet block the case where Treft could produce no read at all; the strictly-concluding check that does is built and not yet proven on a live protected branch.
  • “Signed off by a human” — every approval is a named human decision carrying the grade and its evidence. Shipping below the evidence bar takes explicit consent, and the consent is recorded too.
  • “Auditable later” — the record is append-only and tamper-evident: who approved what, on what evidence, in an audit trail built to survive the retro after the retro.
  • “Stricter where it hurts” — per-project policy can require deeper evidence on sensitive paths and ban unverified ships outright.

What you can require this week

Connect the repositories under the mandate — open pull requests are picked up and graded the moment you connect. Make Treft Verification a required check where the policy demands it. From then on, approvals happen as named, recorded decisions — from a desk or a phone — and the burden of proof moves off your senior engineers and onto the machine that can carry it.

One honest boundary, stated plainly: until the check is required, a merge clicked directly on GitHub does not pass through Treft. The verification page says exactly where that line sits.

Honest by construction

A control you adopt in a hard week has to be straight with you. Treft publishes the false-pass rate of its own verifier — measured against gold, with confidence intervals — and when it cannot verify, the card says unverified instead of pretending. A grade is evidence, not absolution; the mandate’s judgment stays where it belongs, with your people.

The reset’s one-line spec: the author never grades its own work — and every approval has a name on it.

Verify your first PR — free How verification works

No card · choose one repo · disconnect anytime