The missing piece is a join key. A blast radius computed over a catalog graph is a claim about a snapshot: these edges, at this moment, therefore these projects. Write the result back as a catalog property and the inputs stop existing, because the catalog is assembled by integrations that sync from source repositories, CI systems and cloud providers, and is re-derived continuously [3]. What remains is an approval whose inputs have been replaced, in a field the next sync or the next writer can silently overwrite, with part of the judgment coming from an LLM-scored risk value [5]. Store the approval in a mutable field and it holds the evidentiary weight of a comment, however well formatted.
The runtime side has the opposite resolution problem. A gateway can allow or deny a tool call, require a human to approve a sensitive action, and log every request an agent makes, all at the granularity of one action by one agent [7]. The log records that an agent wrote to a file, without a field for which portfolio-level change that write belonged to, what the change was expected to affect, or who accepted responsibility for the whole of it [8]. Two records, no shared change identity. Neither layer is bad at its own job, which is why buying both does not close the gap [1][2].
What would have to be true for this to transfer. The author writes from a single-person AI-native delivery practice where agents produce most of the code, and argues change volume then grows past what anyone can reconstruct from commit history [12][10]. The essay concedes the older arrangement worked: when humans wrote most of the code, the git log was reviewable at human speed and a tech lead could hold the week's changes in their head [9]. So the requirement tracks the agent-authored share of diffs and the number of dependency edges that cross into projects owned by someone else. Inside a single repository, the essay says intent-level governance is a code review discipline; the machinery is for the portfolio case [14].
The evidentiary form is specified as three properties: an impact claim computed deterministically, an immutable and identified snapshot to compute it from, and an approval bound to that exact computation in an append-only record neither the platform nor the requester can rewrite [6]. That sketches a shape; the schema still has to be written. The supplied text promises a minimal implementation and breaks off mid-sentence while introducing what an auditor and an incident responder need from it [15], so there is nothing yet on what identifies the snapshot, where the append-only record lives, or what it costs to keep.
The mechanism holds regardless. A prediction stored where the next sync can replace it stops being evidence of anything the moment the sync runs [5], and the fix needs an identifier that both the catalog and the tool-call log agree on [8]. The price of maintaining that identifier is the part still to be shown.
