// Blog
Engineering insights.
Breaking changes, agent contracts, and where our own guarantees stop.
What a signed receipt can and cannot evidence under DORA, NIS2 and the AI Act
2026-10-02. Legal review pending — this is the author's reading of the texts, not legal advice.
Read articleNineteen agents invented signed messages. One of them trusted a signature without checking it.
What the OpenAI and METR incident reports say about agent-to-agent trust, and where our own guarantees stop.
Read articleWhat Is MCP Governance?
The MCP 2026-07-28 spec takes the protocol stateless — production infrastructure that needs governance. What that means: validating tool schemas, gating actions before they run, and signing every verdict. Verified live against the endpoint.
Read articleWhat Is a Semver Violation — and How Do You Prove One?
A breaking change shipped in a patch or minor release breaks the version-number promise. How to detect one deterministically — and prove it with a signed, verifiable receipt, not a changelog you have to trust.
Read articleWhat is zero-config API governance?
Most governance tools die at the setup step. Zero-config governance is active from the first pull request - it auto-discovers your API contracts, enforces with safe defaults, and still ships a signed, verifiable verdict.
Read articleWhat is agent-safe API governance?
AI agents no longer just read your API - they call it and ship the changes too. Agent-safe API governance catches every contract change at the pull request and signs the verdict, so an agent can verify what changed, not just trust it.
Read articleWhat a breaking-change verdict should tell an AI agent
An API diff tells you what changed. An AI agent needs to know what it means, how to fix it, and whether it is safe to call. A walk through the machine-readable verdict CodeRifts returns on every diff.
Read articleA Discovery and Attestation Protocol for AI Tool Contracts
How an agent gets a current, trustworthy API contract to diff against with zero per-call config. A working sketch: contract by hash, verdict by hash, git for provenance, and the repo itself as a transparency log.
Read articleWhy Registry-Level Validation Is Non-Negotiable for AI Agents
AI agents break silently when APIs change. Here is why catching breaking changes at the diff layer is not enough — and what registry-level validation actually means in practice.
Read articleAzure DevOps PR Validation for OpenAPI Specs (Breaking-Change Detection)
Learn how to add OpenAPI breaking-change detection to Azure DevOps PR validation. Practical pipeline patterns, branch policies, and rollout strategies for platform teams.
Read articleWhen Your API Contract Breaks, Your SBOM Becomes Invalid
SBOMs track your software dependencies, but they are blind to API breaking changes. Learn why API contracts are supply chain artifacts and how to close the gap.
Read articleOptic Is Archived. Here Are Your Options.
Optic, the popular API breaking change detection tool, was archived in January 2026. Here is a fair comparison of the alternatives: oasdiff, Bump.sh, Spectral, and CodeRifts.
Read articleHow a Field Rename Broke 19 Restaurants for a Week
A single API field rename passed code review, passed all tests, and took down POS systems across 19 restaurants. Here is what went wrong and how to prevent it.
Read articleOptic Is No Longer Maintained — Here's How to Keep Catching Breaking API Changes
The popular OpenAPI governance tool was archived on January 12, 2026. If you relied on it for breaking change detection, here's what happened and what your options are now.
Read article