AI writes code fast. SOC2 auditors ask: how do you know what changed, who approved it, and that the record wasn't altered?

Titan Gate answers with cryptographic receipts — not process docs.

Every PR gets evaluated by a three-judge engine (structural, semantic, policy), scored, signed with HMAC-SHA256, chained to the previous receipt, and stored at .titan/receipts/ in your repo.

Any engineer can verify a receipt independently:

  python scripts/titan_verify.py .titan/receipts/2026-03-06/<id>.json --key <key>

Output: VERIFICATION : PASS Signature : VALID Hash : VALID

The audit trail travels with the code. SOC2 controls CC6, CC7, CC8 covered.

One-line GitHub Action integration. 555 tests. Apache 2.0.