change-evidence

Evidence for pull requests written by agents, published on npm.

Published on npm · Shadow mode on Lawyering since November 2026

Creator · 2026 – present · github.com/Semeton/change-evidence ↗

Business goal

Trust a 3,000-line agent pull request without reading every line, by knowing exactly where a reviewer has to look.

Context

–Agents write pull requests faster than anyone can review them line by line, so review turns into skimming.
–The changes that matter most are rarely the biggest: a route that became public, a migration that retypes a column, a query that skips tenant scoping.

Decisions

Never run the code it judges

It reads the pull request's commits as git objects and never checks out, installs, builds or executes them. The workflow runs from the base branch, so a pull request can't edit the check that judges it.

UNKNOWN is never a pass

Routes, migrations, dependencies and CI changes are extracted statically. Anything it can't establish is reported as UNKNOWN and raises the risk tier.

Policy as data, per repository

Default Laravel rules ship as data. A repository adds what only it knows, such as where its tenant boundary is and where money moves, read from the base branch and never from the pull request.

Measure before blocking

A study mode replays a repository's merged pull requests and measures whether the tiers would have routed the right changes to a human. On koel and monica, the low tier held about three quarters of pull requests at a fraction of the bad-outcome rate.

Result

–Published as @semeton/change-evidence and running in shadow mode on Lawyering since November 2026: one report per pull request, never blocking a merge.
–First lesson from Lawyering: committed build output and a codebase-wide scope-bypass pattern drive most flags, so the policy is being calibrated before anything sits in the merge path.

Node.js · Git · GitHub Actions · Laravel