Countersign: No Evidence, No Pass

Countersign is a pre-commit gate for projects where AI agents write most of the code. One human-owned file, countersign.yaml, turns each requirement into a shell check: bandit, detect-secrets, pytest, ruff, and source-level rules like "the DELETE route must still exist". A requirement with no check is UNVERIFIED, never PASS. Any security failure or unverifiable security check blocks the commit, any functional failure blocks it, and quality issues only warn. Every run writes a hash-chained evidence record. watsonx.ai (Granite) reads the failures and explains them in plain language, but the verdict is fixed before the model is called, and a guard withholds any explanation that contradicts the result. Then the record goes to IBM Z through Zowe, where a JCL job re-verifies the exact bytes on USS. CC 0000 approves it and appends it to a ledger on Z; CC 2048 or no answer blocks the commit. z-audit later catches any approved record that was edited. The same rules file drives the hook, a read-only GitHub Action, and IBM Bob's own rules. It installs with one pip command and a python -m countersign init on any existing repo, and a Streamlit dashboard shows every run, its evidence, and the stored watsonx explanation.