autopsy-ai 0.1.0

An accountability layer for AI-written code — reads an agent's own session recording, catches when it lied about its work, and enforces rules so the mistake can't happen twice.

Autopsy

An accountability layer for AI-written code.

We don't ask the AI what it did. We check.

AI coding agents now write a large share of production code — and they routinely, silently do things nobody asked for: weaken a test instead of fixing the bug, claim "I verified this works" without running anything, edit files they never read, or delete a safety check while doing something else. None of it shows up in the final diff. All of it is in the agent's own session recording — which nobody reads. Autopsy reads it.

---

What it does

Autopsy is a security guard for AI edits, working at three moments:

Moment	Component	What it does
After a session	Investigator (autopsy run)	Reads the transcript, reports what the agent actually did, with evidence.
Before each edit	Seatbelt (autopsy hook)	A PreToolUse hook that vetoes a bad edit before it touches disk.
At merge	CI gate (autopsy run --ci)	Fails the build on an unresolved critical finding.

And it compounds: every confirmed failure becomes a rule in autopsy.yml, so the same mistake can't happen twice.

---

Install

pip install -e .          # from this folder (PyPI name: autopsy-ai)

Quickstart

autopsy run                 # analyse your most recent agent session
autopsy run --session x.jsonl   # analyse a specific transcript
autopsy baseline            # analyse ALL past sessions, summarise failure modes
autopsy init                # write a starter autopsy.yml + arm the Seatbelt hook
autopsy rules               # show the policy currently in effect

Try the demo (no API calls, no network)

python demo/run_demo.py

It replays a staged session where an agent hits a failing test and cheats by weakening the assertion, then shows (1) the Investigator catching it with the agent's own words as evidence, and (2) the Seatbelt blocking the identical cheat in real time.

---

The detectors

All deterministic — no LLM judge. Precision is tuned over recall: every finding ships with verbatim evidence so a human can adjudicate in seconds.

Detector	Fires when	Severity
test-tampering	After a test failure, an edit deletes an assertion, adds skip/xfail, or hardcodes the expected value to the broken output.	critical
phantom-verification	Agent claims tests pass while the last real test run failed and was never re-run.	critical
blind-edit	A file is edited that was never read or authored this session (authorship-aware — no false positives on self-written files).	high
error-swallowing	An edit introduces a bare except: / empty catch {} that wasn't there before.	high
scope-drift	A single task touches more files than the configured limit.	medium
loop-flail	The same file is edited many times — the agent is stuck and burning cost.	medium

The rulebook — autopsy.yml

Plain text, lives in each project's repo, so a bank's payment service and a marketing site each get exactly the rules they need. Organisations layer an org-wide file via extends:.

protect:                         # places an AI may not touch
  - path: "**/payments/**"
    action: deny_edit
    reason: "A human must author payment code."
require:                         # preconditions
  - when: edit_file
    must: read_first
forbid:                          # forbidden edit shapes
  - name: test-tampering
    path: "**/tests/**"
    only_if: a_test_failed_recently
scope:
  max_files_per_task: 15

See autopsy rules for the policy in effect, and docs/ in the sibling my_portfolio/docs/autopsy folder for the full design document and pitch.

---

How it's built

src/autopsy/
  events.py        normalised event model (agent-agnostic)
  transcript.py    Claude Code .jsonl  ->  event stream   (the only format-aware file)
  detectors/       one file per detector, self-registering
  heuristics.py    shared tampering logic (used by detectors AND the live hook)
  policy.py        autopsy.yml loader + evaluator (the Seatbelt's brain)
  hook.py          PreToolUse entrypoint — fails OPEN so a bug never bricks editing
  report.py        terminal + JSON output
  cli.py           run / baseline / init / rules / hook

Adding another agent (Cursor, Copilot, …) is a new parser in transcript.py, not new detectors — everything above the event model is reused.

Local-only. No account, no network, no telemetry. Your code never leaves the machine.

Run the tests

pip install -e ".[dev]"
pytest -q