After the incident

The 90-day reset.

For the engineering leader in the week after an AI-attributed incident, when “every agent change needs human sign-off and proof” becomes policy, and the proof is suddenly manual.

The pattern

An incident lands, and the retro attributes it to an agent-authored change that nobody fully read. What follows has the same shape everywhere: a freeze, then a mandate: for the next quarter, every agent change needs a human sign-off and evidence that it was actually checked.

The mandate is right. The way it usually gets implemented is not: screenshots pasted into tickets, review-by-spreadsheet, a senior engineer re-running test suites by hand to prove what CI already claimed. The policy is sound; the tooling is a person. Ninety days of that burns exactly the people the mandate was written to protect, and when it lapses, nothing structural remains.

The policy, productized

Treft is that mandate as a product. Each clause of the reset maps to a mechanism that already runs:

“Independently checked” every change is re-verified from a fresh checkout on a separate machine: exact patch, network cut, your own test suite, an environment the agent never touched.
“With evidence” each verification carries a grade naming exactly what was established, in plain words. Unverified is explicit, never a fake green.
“Enforced, not requested” Treft posts a Treft Verification check on every pull request it verifies. Mark it required in branch protection and GitHub blocks the merge while the check runs and when the clean-room run comes back red. It does not yet block the case where Treft could produce no read at all; the strictly-concluding check that does is built and not yet proven on a live protected branch.
“Signed off by a human” every approval is a named human decision carrying the grade and its evidence. Shipping below the evidence bar takes explicit consent, and the consent is recorded too.
“Auditable later” the record is append-only and tamper-evident: who approved what, on what evidence, in an audit trail built to survive the retro after the retro.
“Stricter where it hurts” per-project policy can require deeper evidence on sensitive paths and ban unverified ships outright.

What you can require this week

Connect the repositories under the mandate. Open pull requests are picked up and graded the moment you connect. Make Treft Verification a required check where the policy demands it. From then on, approvals happen as named, recorded decisions from a desk or a phone, and the burden of proof moves off your senior engineers and onto the machine that can carry it.

One honest boundary, stated plainly: until the check is required, a merge clicked directly on GitHub does not pass through Treft. The verification page says exactly where that line sits.

Honest by construction

A control you adopt in a hard week has to be straight with you. Treft publishes the false-pass rate of its own verifier, measured against gold, with confidence intervals. When it cannot verify, the card says unverified instead of pretending. A grade is evidence, not absolution; the mandate’s judgment stays where it belongs, with your people.

The reset’s one-line spec: the author never grades its own work, and every approval has a name on it.

Verify your first PR — free How verification works

No card · choose one repo · disconnect anytime