Keel Proves AI Coding Agents With Tamper-Evident Records

Overview

A new open-source tool called Keel is aiming to solve one of the most persistent problems in AI-assisted software development: verifying that an agent actually did what it claimed to do. Released as version 0.10.1, Keel provides a framework for tamper-evident records of AI coding work, allowing developers to prove that code changes meet specific criteria without relying on trust alone.

The project, written in Rust and compatible with macOS and Linux, integrates with popular coding agents such as Claude Code, Codex, GitHub Copilot, and Kiro. Rather than replacing these tools, Keel acts as a verification layer that checks whether the output matches the agreed-upon definition of "done."

How Keel Works

The core philosophy behind Keel is that coding agents are excellent at writing code but often lack the judgment to know when their work is complete or correct. Keel fills this gap by introducing a structured workflow that separates intent from execution.

The Three-Step Workflow

The process begins with defining done. Developers write a short specification where every criterion has a test capable of saying no. This spec must be approved before any code is generated. Once the plan is set, the agent works on the task, receiving only the necessary context to minimize token usage and prevent scope creep.

After the agent completes its work, Keel enters the proof phase. The tool runs a series of gates—including builds, tests, and review passes—before requiring human sign-off. Only then is a single file of evidence generated. This bundle contains the hash-linked record of approvals, verdicts, and exact diffs, which can be verified by anyone, even without access to the original repository.

The Gate System

Keel employs a rigorous gating system to ensure quality and security. Each gate answers a specific question and refuses to provide vague answers. For instance, Gate G0 verifies that the spec is answerable and that every requirement is falsifiable. A spec that cannot fail also cannot pass, ensuring that the criteria are meaningful.

Subsequent gates assess the blast radius of changes against the import graph, verify that the code builds and tests pass, and review the diff for security findings. If a check fails or a human has not signed off, the line stops. Nothing ships until every gate is green, preventing agents from quietly shipping unverified code.

Use Cases and Integration

Keel is designed to be flexible, offering value to individual developers, audit teams, and large-scale platform organizations.

For Individual Developers

For anyone using an AI agent, Keel keeps the tool on a short leash. It ensures that a feature is not considered complete until the build is green, a review pass has run, and the developer has explicitly signed off. The tool reports a 14.6× reduction in context fed to the agent, achieving this by handing it outlines and symbols instead of entire files, while maintaining 100% recall.

For Audit and Compliance

In regulated industries, proving the integrity of code changes is critical. Keel allows teams to show auditors exactly what happened during a development cycle. Every approval and verdict is locked into a hash chain. A single command can pack the chain, the spec, the verdicts, and the exact diff into a compressed bundle. This bundle can be verified offline, meaning auditors can check the evidence without needing network access or visibility into private code.

Edit one entry in the evidence chain and every link after it breaks. This tamper-evident property ensures that the record of who approved what remains intact and trustworthy.

For GitHub Teams

Teams using GitHub can add a single step to their workflows to block pull requests that lack proper gating. A PR passes only if it carries the evidence of a passing run of its exact content, or if a maintainer explicitly labels it as exempt. This integrates Keel directly into the existing CI/CD pipeline without requiring significant changes to developer habits.

For Platform Teams

Platform engineers can use Keel to let CI handle the gating within locked-down containers. By using gVisor on GitHub runners, the record is kept outside the reach of the container, ensuring that the agent cannot rewrite its own history. The runner holds the pen, while Keel ensures the record is accurate and immutable.

Why Trust the System

Keel operates on the principle that every claim must be checked, not asserted. The tool itself is built with Keel, meaning every change to its own codebase carries a spec, passes its gates, and ships its own evidence bundle. This self-referential verification adds a layer of credibility to the tool’s claims.

Security and Reliability

The system is designed so that the agent can never mark its own homework. Under sandboxes like moor, the agent has no access to the disk or the internet beyond an allowlist, and the record is written from the outside. On GitHub runners, the use of gVisor ensures that the gate runs in a user-space kernel, with the record explicitly stating whether this environment was available.

Furthermore, Keel never guesses green. It provides three distinct verdicts: pass, fail, or blocked. A check that cannot run results in a blocked status rather than a silent pass. This ensures that failures are always visible and actionable.

Proven Track Record

The tool currently includes 541 tests with zero warnings under strict Clippy settings. It has been tested on real pull requests, covering scenarios where code is covered, uncovered, or exempted. The formats for records and attestations are frozen and change only additively, ensuring that evidence created today will still verify correctly in the future.

Getting Started

Developers can install Keel using Cargo with the command cargo install keel-harness. The installation provides a binary called keel that works with the agent already in use. For those interested in seeing the tool in action, the documentation offers detailed guides on defining specs, approving plans, and running agents through the verification gates.

As AI coding agents become more prevalent in software development, tools like Keel offer a necessary counterbalance. By shifting the focus from trusting the agent to proving the work, Keel helps teams ship faster without sacrificing security or compliance.