Docket: Building Per-Commit Evidence Trails for AI Agent-Generated Code

Who Audits AI-Written Code?

As AI coding agents take on an increasingly active role in real-world software production, a practical problem has emerged: when a piece of code is written by AI rather than a human engineer, how do we know how it was produced, what validation it went through, and whether it can be trusted? Docket is a tool designed precisely for this pain point — it builds per-commit evidence records for code written by AI agents.

In traditional software development, code review, CI testing, and human oversight form the core chain of quality assurance. But when agents automatically generate large volumes of commits, human reviewers struggle to verify the reasoning and validation behind each individual change. Docket aims to turn this "black box" into a "traceable record," so that every commit comes with verifiable evidence.

What Is a "Per-Commit Evidence Record"?

Docket's core idea is to generate a corresponding evidence document for every commit produced by an agent. This record can include the intent behind the code change, the context it was based on, the tests and checks executed during the run, and the verification results.

At its essence, this approach captures "what the AI did, why it did it, and what the outcome was" and binds that information to Git's commit history. This way, when a team traces back an issue, they can see not just "what changed" but also "why it was changed this way" and "whether the change was validated."

For engineering teams that increasingly rely on AI agents to deliver code, this kind of evidence record offers several benefits:

• Auditability: Satisfies traceability requirements in compliance and security review scenarios.
• Trustworthiness: Gives human engineers something concrete to rely on before merging AI-generated code.
• Debugging-friendly: When regressions or defects occur, you can quickly pinpoint the specific commit and its context.

Git's commit history already records diffs and commit messages, but these are typically written by the author themselves, vary widely in quality, and contain no machine-verifiable proof material. Docket's approach is analogous to frameworks in the software supply chain security space — like SBOM (Software Bill of Materials) or SLSA (Supply Chain Levels for Software Artifacts). Those frameworks try to answer "where was this binary built from, and what did it depend on?" Docket, by contrast, tries to answer "which agent generated this commit, in what context, and what verification steps did it go through?" By binding evidence to Git objects, audits can flow alongside version history rather than being scattered across chat logs or log files.

Why Tools Like This Are Emerging

The growing capabilities of AI coding assistants have brought an unintended side effect: the "authorship" of code has become ambiguous, making it harder to assign responsibility and maintain quality control. When an agent can autonomously handle the full pipeline from requirement understanding to code commit, traditional trust mechanisms are no longer sufficient.

The direction Docket represents is about filling the "trust and evidence" gap in AI-human collaborative development workflows. It doesn't try to replace CI/CD or code review — it acts as an additional layer of record-keeping to make AI-involved development more transparent.

At a broader level, this class of tools represents the concrete application of "AI governance" within software engineering. As enterprises accelerate their adoption of AI programming, ensuring code quality, security, and compliance while gaining efficiency gains will become a new challenge for engineering management. Per-commit evidence records are a pragmatic attempt to address that challenge.

CI/CD (Continuous Integration/Continuous Delivery) serves as the automated quality gate of modern software engineering: after a commit is pushed, the pipeline automatically runs tests, static analysis, and build validation, and only allows merging or deployment upon passing. However, CI/CD fundamentally only verifies whether the code's "outcome is correct" — it doesn't record "how the decision was made." When an AI agent can produce dozens or even hundreds of commits per day, even if all tests pass, engineers still face a blind spot: what context was this code reasoned from? Were certain checks deliberately circumvented? Did the agent truly understand the real intent behind the requirements? Docket addresses exactly this layer that CI/CD doesn't cover — it doesn't replace testing, but adds narrative evidence to test results: "why these tests were run and what the results actually mean."

Current Limitations and a Wait-and-See Stance

It's worth noting objectively that Docket currently has relatively low traction on Hacker News (8 points, 1 comment), and publicly available information is limited. This means it's still at an early stage, and its actual effectiveness, integration costs, and real-world team adoption all remain to be seen.

For developers who follow the AI programming toolchain, the thinking behind Docket is worth paying attention to: as more and more code is written by machines, we need corresponding mechanisms to record and verify the machine's work. Tools that "audit AI-generated code" like this may well become standard fixtures as agentic programming becomes more widespread.