Atomi Evidence Gate

What the company appears to be: Atomi Evidence Gate is a self-reported tool for software acceptance that ties an approved check to a frozen source tree and records a run with HMAC-authenticated receipts. It operates by snapshotting code, rejecting symlinks and sensitive files, running checks in a Docker container with strict isolation, and generating a private receipt.

What changed: The project evolved from a broader marketplace and audit platform into a focused tool for verifying that a specific check ran against a frozen source tree. This shift occurred during Build Week, where the author pared down the scope to focus on one core problem: ensuring checks are tied to specific code snapshots.

The single most important open question: Is there any evidence of real-world usage or integration beyond the author's own tests and demos? The description states that this is an alpha project with no revenue, customers, or traction data. There is no indication of adoption or deployment in production environments.

The description states that Evidence Gate:

• Accepts a source directory and check definition authenticated with HMAC
• Snapshots the source and rejects symlinks, special files, sensitive filenames, and key material before Docker starts
• Runs checks from a Docker image whose digest is recorded in approval
• Mounts the source read-only, runs Docker with no network, non-root user, and resource limits
• Verifies settings it actually received
• Hashes input again upon completion, records cleanup, and writes an event chain and private receipt authenticated with HMAC

The author describes this as a deterministic code-based approach to auditing, not involving AI models in the assessment path. The tool is built using Python, Docker CLI, and standard libraries.

Evidence: Self-reported by the author; no third-party verification or independent testing data provided.

The author initially described the idea as an “AI auditor,” which suggests a broader scope involving AI models. However, they later refined the approach to focus on deterministic code-based checks.

The current positioning is:

• A tool for software acceptance with digest-pinned checks
• HMAC-authenticated receipts
• Designed to prevent tampering and ensure reproducibility

Inference: The evolution from "AI auditor" to a deterministic check system indicates a shift toward clarity and technical focus, possibly in response to complexity or scope creep.

Evidence: Self-reported by the author; no external positioning or branding data provided.

The description does not identify specific customer segments or personas. The author mentions:

• A CI integration for team-owned checker policies as a next step
• The tool is designed to be used in development environments where code verification and reproducibility are important

Inference: Likely targets teams or developers who need to verify that checks run against specific code versions, particularly in CI/CD pipelines.

Evidence: Not evidenced; no customer data, personas, or use cases provided.

There is no evidence of a business model or pricing structure. The author states:

• This is an alpha project
• No production-ready status
• No mention of monetization or commercial offerings

Evidence: Not evidenced; no revenue, pricing, or commercial strategy described.

The author reports:

• Built with Python, Docker CLI, standard libraries
• Uses GPT-5.6 Sol for development assistance (not in the assessment path)
• Core functionality is deterministic and makes no model calls
• Includes 28 unit and adversarial tests
• Real Docker end-to-end run
• Fresh Ubuntu CI
• No rebuild judge bundle with wheel, prebuilt images, source commit, checksums
• Demo scenarios run without OpenAI API key or paid services

Evidence: Self-reported; no independent technical validation or delivery data provided.

The author states:

• This is still an alpha project
• No external security review conducted
• No production-ready status
• No revenue, customers, or adoption data

Evidence: Not evidenced; no traction, usage, or maturity metrics provided.

No information is given about competitors or market positioning. The author does not reference similar tools or platforms in the marketplace.

Evidence: Not evidenced; no competitive analysis or market context provided.

• Alpha status: The project is described as an alpha and not production-ready
• No external review: No mention of security reviews or third-party validation
• Self-reported only: All information comes from the author’s own account, with no independent verification
• No commercial traction: No evidence of revenue, customers, or adoption
• Limited scope: The tool is narrowly focused on one specific problem and has not been integrated into broader workflows

Inference: The lack of external validation and real-world usage raises questions about scalability and readiness for production use.

1. What are the specific use cases or workflows where this tool would be deployed?
2. Has there been any internal testing or pilot with teams using it in CI/CD pipelines?
3. How does the tool handle edge cases or failures in Docker environments?
4. Are there plans for external security audits or third-party validation?
5. What is the roadmap for moving from alpha to production-ready status?