acme-payments/payments-apiPublic
Payments API of a fictional EU fintech, built with IBM Bob under Origit. Synthetic data only.
Git tells you what changed.
Origit tells you what the agent read before it changed it.
Every commit an AI coding agent makes carries a hashed record of what it read, wrote, added and ran. When a package or README turns out to be poisoned, you get the affected commits, sessions, files and the roll-back point in seconds.
$ origit taint fast-pay-utils
3 commits affected
Sessions: #42, #43, #44
Files: src/payout-export.ts, src/payment-utils.ts
Approver: bernard (26 Sep 2026 14:02 UTC)
First read: session #42, 24 Sep 2026 09:14 UTC
Roll back: commit e19b…770One command on incident day
The EU Cyber Resilience Act gives a manufacturer 24 hours from reading an advisory to warn ENISA. Without a record of what the agent read, that window goes on archaeology. With Origit it goes on the response.
Record
Bob IDE hooks trace every tool call. At commit time the trace becomes a canonical, SHA-256-hashed record in refs/notes/origit.
Taint
Ask for a package, file or content hash. Affected commits, sessions, approver, first read and the last clean commit come back together.
Review
A deterministic pre-filter runs on every push. Only when it fires does IBM Bob read the trace and write cited evidence per OWASP Agentic Top 10 category.