Autopsy

An accountability layer for AI-written code.

We don't ask the AI what it did. We check.

AI coding agents now write a large share of production code — and they routinely, silently do things nobody asked for: weaken a test instead of fixing the bug, claim "I verified this works" without running anything, edit files they never read, or delete a safety check while doing something else. None of it shows up in the final diff. All of it is in the agent's own session recording — which nobody reads. Autopsy reads it.

What it does

Autopsy is a security guard for AI edits, working at three moments:

And it compounds: every confirmed failure becomes a rule in autopsy.yml, so the same mistake can't happen twice.

Install

pip install -e .          # from this folder (PyPI name: autopsy-ai)

Quickstart

autopsy run                 # analyse your most recent agent session
autopsy run --session x.jsonl   # analyse a specific transcript
autopsy baseline            # analyse ALL past sessions, summarise failure modes
autopsy init                # write a starter autopsy.yml + arm the Seatbelt hook
autopsy rules               # show the policy currently in effect

Try the demo (no API calls, no network)

python demo/run_demo.py

It replays a staged session where an agent hits a failing test and cheats by weakening the assertion, then shows (1) the Investigator catching it with the agent's own words as evidence, and (2) the Seatbelt blocking the identical cheat in real time.

The detectors

All deterministic — no LLM judge. Precision is tuned over recall: every finding ships with verbatim evidence so a human can adjudicate in seconds.

The rulebook — autopsy.yml

Plain text, lives in each project's repo, so a bank's payment service and a marketing site each get exactly the rules they need. Organisations layer an org-wide file via extends:.

protect:                         # places an AI may not touch
  - path: "**/payments/**"
    action: deny_edit
    reason: "A human must author payment code."
require:                         # preconditions
  - when: edit_file
    must: read_first
forbid:                          # forbidden edit shapes
  - name: test-tampering
    path: "**/tests/**"
    only_if: a_test_failed_recently
scope:
  max_files_per_task: 15

See autopsy rules for the policy in effect, and docs/ in the sibling my_portfolio/docs/autopsy folder for the full design document and pitch.

How it's built

src/autopsy/
  events.py        normalised event model (agent-agnostic)
  transcript.py    Claude Code .jsonl  ->  event stream   (the only format-aware file)
  detectors/       one file per detector, self-registering
  heuristics.py    shared tampering logic (used by detectors AND the live hook)
  policy.py        autopsy.yml loader + evaluator (the Seatbelt's brain)
  hook.py          PreToolUse entrypoint — fails OPEN so a bug never bricks editing
  report.py        terminal + JSON output
  cli.py           run / baseline / init / rules / hook

Adding another agent (Cursor, Copilot, …) is a new parser in transcript.py, not new detectors — everything above the event model is reused.

Local-only. No account, no network, no telemetry. Your code never leaves the machine.

Run the tests

pip install -e ".[dev]"
pytest -q