Coproduct Verify · GitHub App
Install Coproduct Verify
Every pull request on your repo gets a Coproduct/verify check-run with a signed receipt trail. One click to install. 60 seconds to first badge.
What it does: On every pull_request
open or sync, the App posts a check-run that deep-links to
coproduct.one/verify/<sha> — the buyer-facing view
of the reasoning trail, pillar status, oracle drill-down, and
cross-agent safety check for that commit.
What it does not do: No code is executed on your runners. No write access beyond the check-runs the App creates. No data leaves your repo that isn't in the PR body + the signed receipt bytes.
- Click Install on your repo above and pick which repositories to enable.
- GitHub sends us an
installation.createdwebhook — we record the installation and respond 200 within ~50ms. - On your next PR, watch for the
coproduct/verifycheck-run on the PR conversation view. Click Details to land on/verify/<sha>with the full capture-and-verify trail.
Framing — capture and verify, not byte-deterministic replay
Coproduct Verify implements a capture-and-verify model. Every reasoning step, oracle result, and pillar attestation on your PR is cryptographically signed. Any third party holding the snapshot JSON plus our public key can verify the capture is authentic. What we explicitly do not guarantee is that the LLM output itself is byte-for-byte reproducible — that's a research- grade problem no vendor solves today. See our model doc for the exact split between what we guarantee and what we don't. EU AI Act Annex III requires signed logs, not byte replay; we meet that bar.
Required Fly secrets (for self-hosted deploys)
Skip this section if you're using the hosted version at
coproduct.one. For self-hosting:
fly secrets set GITHUB_APP_WEBHOOK_SECRET=<hex>
fly secrets set GITHUB_APP_ID=<numeric id from App settings>
fly secrets set GITHUB_APP_PRIVATE_KEY="$(cat ~/downloaded.pem)"