Bob, Verified

Bob does the code review. This project asks the next question: how do you know it actually did what it says? AI coding agents are usually graded on whether their summary sounds right, not on whether it matches what happened on disk. For a review tool, that gap is the whole product failing at its one job — you end up trusting the reviewer's word about the review, with no way to check it. This harness wraps Bob's Agent mode with two small, zero-dependency Python libraries built for exactly this: sipa-trace turns every tool call Bob makes into a hash-chained, risk-classified record. The classifier is deterministic and rule-based — it looks at tool capability (does this write, delete, touch the network, touch credentials), never at Bob's own judgment of its own action. An unrecognized tool falls through to the lowest risk tier by design, so it gets flagged for a human instead of silently waved through. verify() walks the whole chain afterward and confirms nothing was edited after the fact. sipa-signal runs Bob's own written explanation through a deterministic filter before a human reads it, stripping hedging and filler language. It's pattern-based, not another model summarizing Bob's summary — a second LLM in that role would just relocate the trust problem. The tool→risk mapping is generic on purpose: it classifies what kind of action a call is, not the domain of the task, so the same harness works on any repo Bob is pointed at. We ran it for real: Bob reviewed a sample file, made one tool call (read_file), correctly classified as no-risk, hash chain verified clean, and Bob's own review text passed the filter as CLEAN with 0% filler in that run. Task ID and exact numbers are in the repo. Impact: this turns "the AI said it worked" into something with a paper trail — a small, cheap step toward AI-assisted code review a team can actually rely on.