Humans approve intent, machines prove conformance

Cloudflare has a new idea for Git, and it starts from a blunt observation: agents can write code faster than people can read it. On October 1, the company published a call for the next Git platform, asking how agent work should coordinate, how conflicts get handled, how reviews should happen, and how to record why a change was made. That was enough to push one builder to spend the next week on something called gittifacts, an agent-native Git platform running on Cloudflare.

The core idea is simple enough to fit on a T-shirt: humans approve intent, machines prove conformance. That flips the usual pull request model on its head. Instead of asking a person to inspect a huge diff after an agent has already blasted through 500 lines, the system asks for a plan first. A human approves the intent, acceptance criteria, scope, and expected paths touched. Only then does the agent get a fork, a scoped push token, and a short loop for making the change.

From there, every change gathers evidence. CI runs, then proof steps on top of it: red/green checks for fixes, coverage and mutation scores on changed lines, public API diffs, dependency diffs, hits on sensitive paths, and preview deploys. The platform signs that bundle and stores it with the repository as a git note on the head commit. A pure function then sorts the change into one of three lanes: auto-merge, quick review, or full review. Missing or errored signals can only raise the lane, never lower it.

The review flow is built to keep humans away from raw diffs unless they really need them. A separate reviewer agent writes a walkthrough ordered by risk, pointing every claim back to evidence and calling out what it is least confident about. Only the merge queue writes main, and it does so on trees that passed CI on exactly that tree. Merged changes ship behind their own feature flags, and if errors rise, the platform turns the flag off, rolls back, and opens a revert change.

The builder says the project is not just theory. He imported the repository into the live platform, had an agent open six changes, reviewed them, and watched the queue land them. That surfaced five platform fixes, including blockers like a fork that could not be cloned, a default pipeline that could not adopt its own CI config, a missing queue replay blob, and a dropped build that stalled the queue for 90 minutes. The platform is open source under MIT and can run locally without a Cloudflare account.

But the sharpest part is also the least glamorous: this only works if someone writes a good plan. If the intent is wrong, fast proof just gets you to the wrong place faster. That is the real argument here, and it lands harder than any amount of agent swagger.