BobGuard: Enterprise AI Code Provenance Gateway

The Problem: As enterprises rush to adopt AI coding assistants, they face a massive "Shadow AI" risk. AI models can hallucinate non-existent npm packages (slopsquatting malware risks), introduce OWASP security vulnerabilities, or inject strict GPL-licensed code that legally compromises proprietary software. Currently, security teams lack visibility into what code was written by AI versus humans. Discovering these issues late in the CI/CD pipeline or during manual Pull Requests costs significant time, money, and rework. The Solution: BobGuard is an automated, Shift-Left DevSecOps governance gateway. We built a dual-folder monorepo consisting of a vulnerable sandbox (OWASP NodeGoat) and an Express/React auditor platform. BobGuard intercepts code at the exact moment a developer runs git commit. It pauses the commit and triggers a Node.js backend that orchestrates IBM Bob 2.0 subagents in the background to analyze the staged diff against an enterprise .ai-policy.json ruleset. Target Users & Interaction: The primary users are Enterprise Developers and Security/Compliance Managers. 1) Developers interact with it seamlessly via the CLI. The Git pre-commit hook runs silently. If a policy is violated, the commit is blocked, and the developer instantly receives terminal feedback with an Auto-Remediation patch to fix it locally. 2) Security Managers interact with the React Dashboard (Enterprise Command Center), which visualizes real-time metrics like AI Provenance Ratios, License Contamination, and Vulnerability Density. Why It's Creative & Unique: Instead of using AI merely to write code, BobGuard uses IBM Bob as an active compliance enforcer. It generates a cryptographically signed SHA-256 AI Bill of Materials (AI-BOM) for every commit and saves it to MongoDB. If BobGuard detects a flaw, Subagent C acts as an Auto-Remediation engine to hand the developer a secure patch immediately. It turns AI from a compliance risk into its own governance solution.