Make AI agents prove what they checked.
Slipmark binds every AI agent verdict to a SHA-256 hash of the exact files the agent read. Before anything ships, the gate re-hashes them and refuses if anything changed.
It is live and open source. It runs as a GitHub Action. Formerly DriftGuard.
Attestation record
Re-hash before ship
Files unchanged since approval
- Approved
- sha256 3a7f 09c2 e41b … c91e
- Before ship
- sha256 3a7f 09c2 e41b … c91e
In registerHashes match. It ships.
A file changed after approval
- Approved
- sha256 3a7f 09c2 e41b … c91e
- Before ship
- sha256 8d02 71fa 3c6e … b4a7
RefusedOut of register. Nothing ships.
The verdict is bound to a SHA-256 hash of the exact files the agent read.
- Status
- Open source
- Version
- v0.2.0
- Released
- 17 October 2026
- Licence
- Apache-2.0
Add it to a workflow.
Add this step to a GitHub Actions workflow. Setup and inputs are in the README on GitHub.
Read the README on GitHub- uses: founder-ship-it/Slipmark@v0.2.0The agent asserts. You trust.
Autonomous agents produce clearance verdicts. Security audits, QA passes, review approvals. Nothing binds a verdict to what was actually inspected.
That works until it does not, and when it fails it fails silently, because a broken control still reports success.
A gate that reported green for months.
Our own nightly pipeline runs 20+ autonomous agents that research, architect, audit, build and QA production code.
One security audit gate had been inspecting the wrong branch since 20 May. It reported green for months. It could not fail.
No monitoring would have caught it. The control was working correctly. It was just working on the wrong thing.
What happened when we turned it on
Internal
23/23
Pointed at 23 open agent pull requests, it refused all 23.
RefusedInternal figure, from our own agent pipeline.
Attestation is bound to an artifact rather than asserted by the agent.
- 01
Record
The agent's verdict is bound to a SHA-256 hash of the exact files it read.
- 02
Re-hash
Before anything ships, the gate re-hashes those files.
- 03
Refuse
If anything changed, it refuses. Nothing ships against a stale verdict.
- 04
Behavioural locks
Slipmark's drift diagnosis lets you codify behavioural locks. In ReplyOS we use it to lock tenant isolation, enquiry capture and email threading.
Where it sits.
Controls define what an AI is allowed to do. Slipmark checks that what an agent approved is still what ships after someone changes the software.
A permission that stops applying after the next pull request is not much of a control. A gate that refuses on mismatch is what keeps it in force. It does not prove an agent behaves correctly. It detects when what was approved is no longer what ships.
AI controls, testing and oversightWhy it is called Slipmark
A slip mark is the paint line engineers draw across a bolt once it has been tightened and checked.
If the bolt moves, the line breaks.
Status
- 01Live and open source under the Apache-2.0 licence.
- 02Version v0.2.0, released 17 October 2026.
- 03Runs as a GitHub Action.
- 04Also includes drift diagnosis for AI features.
- 05Running in production inside our own ReplyOS pipeline.
Get updates on the paid layer
Slipmark is free and open source. A paid layer is coming: a hosted dashboard, evidence reports, team policies and setup help. Leave an email address to hear when it is ready.
- Hosted dashboard
- Evidence reports
- Team policies
- Setup help