The problem How it reaches you How it works Get early access

Why is the pull request
where you find out?

Governance for coding agents Prevent upstream, verify downstream.

Get early access →
What the agent gets

Your agents build ondecisions your team already made.

Your team already agreed how things get built. bibup hands those decisions to the agent before it writes a line.

bibup / conformance
off path The sanctioned pattern is retry-with-backoff v3, ratified by J. Whitaker, after two rollbacks of the approach used here. Neutral. Information, not a failure.
A red check says violation. This says information, and it says who signed it.
What keeps happening

Producing code got easy.
Producing it well didn't.

Ten years ago, whether code came out well depended on who wrote it. Now anyone can produce code, and building it the way this team already agreed still fails. You have seen at least two of these. Probably this quarter.

Revived

Code that was retired,back in the build.

The agent found it, decided it looked useful, and wired it in. The decision to kill it lived in a thread, in a call, in somebody's head. Never in the code.

A crumpled paper climbing out of a tipped-over bin on its own, with Bibu trying to stop it
Duplicated

The same fix,written four times.

Four repos, four people, four different patches. You find out which one was right when production tells you.

Four plasticine padlocks in a row, three of them broken, with Bibu looking at them
Context lost

Green locally.Down in prod.

Nobody on that branch knew what the flag was actually for. Somebody three teams over did. The agent said the change was logically correct. It was. Logically.

Two plasticine traffic lights, a green one standing and a red one toppled, with Bibu between them
Vendored

A whole repository,for one module.

All of it, dependencies and all, because somebody needed one file-upload module.

Bibu dragging an enormous crate with one tiny piece inside it

If it helps to know it is not just you: duplicated blocks are up 81% since 2023, and moved code, the proxy for refactoring, fell from 21% to 3.8%.

GitClear, 623M code changes analysed, 2023 to 2026

Get early access →
How it reaches you

Nothing new for yourengineers to learn.

No editor, no plugin, nothing new in anyone's day. Two things get installed once, by your platform team: an MCP server your agents already know how to call, and one signed binary in the CI you already run. Your code never leaves it.

We are building it to be the layer, not the app.

01Your agent Claude Code, Cursor or Codex, before it writes a line.
02bibup, over MCP Answers for this repo, this path, this moment.
03Your pipeline One signed binary, in the CI you already have.
04The pull request The check concludes, quiet unless a rule was broken.
05The receipt One per change, kept on our side, so the answer survives.

what bibup adds    what you already run

Why upstream

Nobody should have to be the memory of a company.

The dam

Somebody on your teambecame the dam.

They are the one who remembers what got rolled back two years ago, so every change waits on them. They never asked for the job.

Plasticine Bibu with her shoulder against a brick wall, straining to hold back a mass of written slips coming over it
Out of reach

Somebody already knew.It was nowhere she could reach.

Every one of those was knowable before the first line was written. It just was not anywhere the person writing the code could get to it.

Plasticine Bibu with her head buried inside a filing cabinet drawer, searching, with papers spilling out everywhere

We are building the thing that speaks up the second time somebody goes to write it.

Get early access →

How it would go

One change, from the ask to the record.

The same change all the way through, the way it goes once the rules are already there. Every word this product uses is introduced where it is needed, once.

010203
01

Before the code exists

Monday. Bibu asks her agent for a rate limiter on the payments API.

Today Plasticine Bibu sitting very small in the middle of a collapsed outdoor library, shelving units toppled and folders strewn across the grass, looking up with no idea where to start

Nobody has the week

Designing it properly against the system means a week of digging. She is not going to. She describes what she wants and reviews what comes back.

With bibup The same outdoor library standing upright and in order, with plasticine Bibu holding one open page in her paws, reading it

It arrives with the ask

Her agent already has what this team decided, resolved for this repo, before she writes a line.

golden path a pattern somebody here ratified, with their name and the date.

02

When she pushes back

She has a reason to do it differently. She says so.

Today A cobblestone plasticine path forking, with the branch worn down to bare dirt by rows of paw prints and no signage at all, and plasticine Bibu standing on it looking back

She steps off the path

She does it anyway, and somebody catches it at review. Or nobody does.

With bibup The same fork, with that branch now laid in stone and a small wooden gate across it carrying a tag that reads signed, and plasticine Bibu walking through

The detour is signed

The agent names the rule and its owner, and she asks for an exception right there.

detour a signed exception, with a reason, a scope and an expiry date.

Somebody above her signs it, never her. An exception you approve for yourself is how a set of rules turns into a list of things people clicked through.

03

What the pull request says

Thursday. The change is ready to merge.

Today A stack of pale plasticine papers on a wooden table, bristling with dozens of small red flags, and plasticine Bibu going through it under a magnifying glass

Findings everywhere

You find out here, or in production, which is later and costs more.

With bibup The same table and the same stack, now with two red flags in it, and plasticine Bibu sitting beside it, relaxed

On path, receipt issued

Things she slipped on, not two hundred things nobody told her.

on path and a receipt, which is what stays after everyone forgets.

A quiet check is the working state, not the idle one. It is also the one that leaves evidence behind.

Step one · The rules

Somebody already got this right. You just can't find them.

Said

What your teamsaid.

The ADR nobody reopened, the design doc from two years ago, the contribution guide, the deprecation note, the rules file your agents read. Thin, out of date, and honest about intent.

Did

What your teamactually did.

Every fix, every revert, every 2am hotfix, every import. Complete and impossible to argue with, and it never tells you why anyone did it.

They agreeA candidate. Said and did line up. Worth proposing.
They disagreeThe finding. Agreed on and nobody follows, or everybody does it and nobody wrote it down.
A person signsA rule. The system proposes. You ratify. Never the other way round.
Ratify
A pile of plasticine paper receipts, each typewritten with a change number, who ratified it and the verdict, with Bibu behind them

Every tool reviews the code in front of it.

This one remembers what this company already paid to learn.

Get early access →
Step two · The check

A check that stays neutral, until a ratified rule is broken.

It will block in exactly one case: a rule this organisation ratified, broken with no detour signed. If the context did its job upstream, there is nothing left to block.

And when we are unreachable, your merges are not. The check concludes on its own for up to an hour on the last signed rules it holds, then fails closed. That is the whole promise, including the ceiling on it.

Example output
bibup / conformance · on path, receipt issued The change matches a pattern this organisation already ratified. A receipt will be issued.
Nothing to read, nothing to argue with. The quiet state is the one you want, and it is the one that leaves evidence behind.
Example output
bibup / conformance · off path The sanctioned pattern is retry-with-backoff v3, ratified by J. Whitaker, after two rollbacks of the approach used here. Neutral. Information, not a failure.
A red check says violation. This says information: your change took another route, and here is what somebody here already learned about that route.
Example output
bibup / conformance · detour open A signed exception, with a reason, a scope and an expiry date. All three go into the record.
Asked for in the spec, a detour is a design conversation. Asked for at the merge, it is a blocker. Same object, different moment. That is why we want to meet you before the code exists.
Step three · The record
The record as an object: a sheet of aged paper, typewritten and sealed with the print of the paw of Bibu

Years from now, someonecan still read it.

Names, not policies. Every line says who ratified it and when.

The gaps are in it. What expired and what was never covered, on the cover.

It outlives the people. The reason survives the person who had it.

Get early access →

Early access

Come build it with us.

We are writing the first version now. The people on this list are the ones we ask before we decide anything, and the first with their hands on what comes out.

You are in. We will come to you with questions first, and the build right after.

Three optional questions

Get early access