PortaStack is the governance kernel I built to enforce that line. Authority, evidence, verification, and approval stay explicit and auditable, no matter how much of the work an AI actually did. It's the control architecture underneath every project on this site.
AI-assisted development has a trust problem. An agent can write the diff, run the tests, and report that it's done, and there's no structural reason to believe the summary over the raw evidence. PortaStack closes that gap with nine deterministic invariants.
No industry assumption, no certification regime, no customer baked in. It's a control architecture that gets mapped onto whatever governance model is already in place.
An orchestrator routes work to a scoped executor. The executor writes to an append-only evidence journal. A reviewer reads that journal directly and never sees the executor's summary. A policy gate checks for both evidence and approval before anything releases.
The reviewer never receives a summary from the executor. It reads the same append-only journal independently. That single design choice is what turns "the agent says it passed" into something you can actually check.
PortaStack doesn't assume an orchestrator, a language, or a toolchain. Whatever a system already has, it maps onto the same control-plane roles:
A control plane that can tell you what actually happened.