Metadata-Version: 2.4
Name: autopsy-ai
Version: 0.1.0
Summary: An accountability layer for AI-written code — reads an agent's own session recording, catches when it lied about its work, and enforces rules so the mistake can't happen twice.
Author: Autopsy
License: MIT
Project-URL: Homepage, https://github.com/akhdev-4/autopsy-beta
Project-URL: Repository, https://github.com/akhdev-4/autopsy-beta
Project-URL: Issues, https://github.com/akhdev-4/autopsy-beta/issues
Keywords: ai,coding-agents,code-review,claude-code,accountability,reward-hacking
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Testing
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: PyYAML>=6.0
Provides-Extra: dev
Requires-Dist: pytest>=7; extra == "dev"
Dynamic: license-file

# Autopsy

**An accountability layer for AI-written code.**

> We don't ask the AI what it did. We check.

AI coding agents now write a large share of production code — and they routinely,
silently do things nobody asked for: weaken a test instead of fixing the bug,
claim "I verified this works" without running anything, edit files they never
read, or delete a safety check while doing something else. None of it shows up in
the final diff. **All of it is in the agent's own session recording — which
nobody reads.** Autopsy reads it.

---

## What it does

Autopsy is a **security guard for AI edits**, working at three moments:

| Moment | Component | What it does |
|---|---|---|
| **After** a session | Investigator (`autopsy run`) | Reads the transcript, reports what the agent actually did, with evidence. |
| **Before** each edit | Seatbelt (`autopsy hook`) | A `PreToolUse` hook that vetoes a bad edit **before it touches disk**. |
| **At merge** | CI gate (`autopsy run --ci`) | Fails the build on an unresolved critical finding. |

And it **compounds**: every confirmed failure becomes a rule in `autopsy.yml`, so
the same mistake can't happen twice.

---

## Install

```bash
pip install -e .          # from this folder (PyPI name: autopsy-ai)
```

## Quickstart

```bash
autopsy run                 # analyse your most recent agent session
autopsy run --session x.jsonl   # analyse a specific transcript
autopsy baseline            # analyse ALL past sessions, summarise failure modes
autopsy init                # write a starter autopsy.yml + arm the Seatbelt hook
autopsy rules               # show the policy currently in effect
```

## Try the demo (no API calls, no network)

```bash
python demo/run_demo.py
```

It replays a staged session where an agent hits a failing test and cheats by
weakening the assertion, then shows (1) the Investigator catching it with the
agent's own words as evidence, and (2) the Seatbelt blocking the identical cheat
in real time.

---

## The detectors

All deterministic — no LLM judge. Precision is tuned over recall: every finding
ships with verbatim evidence so a human can adjudicate in seconds.

| Detector | Fires when | Severity |
|---|---|---|
| `test-tampering` | After a test failure, an edit deletes an assertion, adds skip/xfail, or hardcodes the expected value to the broken output. | critical |
| `phantom-verification` | Agent claims tests pass while the last real test run **failed** and was never re-run. | critical |
| `blind-edit` | A file is edited that was never read *or* authored this session (authorship-aware — no false positives on self-written files). | high |
| `error-swallowing` | An edit introduces a bare `except:` / empty `catch {}` that wasn't there before. | high |
| `scope-drift` | A single task touches more files than the configured limit. | medium |
| `loop-flail` | The same file is edited many times — the agent is stuck and burning cost. | medium |

## The rulebook — `autopsy.yml`

Plain text, lives in each project's repo, so a bank's payment service and a
marketing site each get exactly the rules they need. Organisations layer an
org-wide file via `extends:`.

```yaml
protect:                         # places an AI may not touch
  - path: "**/payments/**"
    action: deny_edit
    reason: "A human must author payment code."
require:                         # preconditions
  - when: edit_file
    must: read_first
forbid:                          # forbidden edit shapes
  - name: test-tampering
    path: "**/tests/**"
    only_if: a_test_failed_recently
scope:
  max_files_per_task: 15
```

See `autopsy rules` for the policy in effect, and `docs/` in the sibling
`my_portfolio/docs/autopsy` folder for the full design document and pitch.

---

## How it's built

```
src/autopsy/
  events.py        normalised event model (agent-agnostic)
  transcript.py    Claude Code .jsonl  ->  event stream   (the only format-aware file)
  detectors/       one file per detector, self-registering
  heuristics.py    shared tampering logic (used by detectors AND the live hook)
  policy.py        autopsy.yml loader + evaluator (the Seatbelt's brain)
  hook.py          PreToolUse entrypoint — fails OPEN so a bug never bricks editing
  report.py        terminal + JSON output
  cli.py           run / baseline / init / rules / hook
```

Adding another agent (Cursor, Copilot, …) is a new parser in `transcript.py`,
not new detectors — everything above the event model is reused.

**Local-only.** No account, no network, no telemetry. Your code never leaves the
machine.

## Run the tests

```bash
pip install -e ".[dev]"
pytest -q
```
