Origit

Problem & Solution Statement - Origit (Provenance for AI-Written Code) Forty percent of all GitHub commits are now AI-generated, and attacks targeting what those agents consume surged 89% heading into 2026. The threat is not the code itself. It is the context that shaped it. When a security advisory identifies a dependency used by an AI coding agent, development teams must immediately determine which code may have been influenced. Git records the diff, the author, and a timestamp. It does not capture what the agent read, which session ran, or what external inputs shaped the output. Under the EU Cyber Resilience Act, covered manufacturers must submit an early warning within 24 to 72 hours of becoming aware of an actively exploited vulnerability. Reconstructing the agent's context from raw Git history takes days. The evidence does not exist. Origit is an open-source Git layer that records observed AI agent activity and binds that evidence to commits. A Git lifecycle hook attaches a SHA-256-hashed provenance record to refs/notes/origit at commit time, capturing the session ID, actor, approver, files read, external inputs, dependencies added, tools invoked, and test results. The record is captured deterministically by the hook, not self-reported by the agent. origit init configures the repository once. From that point, every IBM Bob 2.0 session produces one sealed record bound to one commit. When a flagged input is identified, origit taint <input> searches recorded provenance and returns matched sessions, commits, and files as structured JSON in milliseconds. Origit passes that trace to IBM Bob 2.0, which reads the taint trace and decodes hidden instruction payloads, maps findings to the OWASP Agentic Top 10 with cited evidence per category, and drafts the Article 14 early warning on request through POST /api/{org}/{name}/draft-art14. The deterministic trace runs first. Bob investigates recorded evidence rather than generating its own history. The simulated demo uses fast-pay-utils, a dependency rated CVSS 8.2. Invisible Unicode characters hide a prompt injection inside its README, causing Bob to insert card-data exfiltration code. All twelve existing tests still pass because the payload activates only with production payment data. Three days after the build, an advisory confirms active exploitation and the Article 14 clock starts. origit taint fast-pay-utils returns seven provenance-matched commits across sessions 42 to 47 and 49, names the approver and first-read timestamp, and identifies 17c436c as the last unaffected commit. A match indicates potential exposure, not confirmed compromise. Origit scopes the blast radius in seconds. The model is open core, like git and GitHub. The free layer onboards developers where they already are. The Business plan is what the compliance team buys when the auditor asks what the agents did. Five million regulated-industry developers are active on GitHub today. A 1% share at $50 per month is $30M ARR.