Panout defensibility candidates, round 1 (2026-09-03)
Constraints every idea must respect (learned from killed versions):
- Panout does not control agents. 2. Panout stays out of the live agent loop. 3. The human never has to log in anywhere; repo + terminal only.
- No duplicate agent runs to generate training data. 5. Raw transcripts stay local; metadata only by default.
Founder: solo, ~5 months runway, runs several coding harnesses daily, does not read issue trackers, writes decision logs prolifically.
Idea 1: The underwriter of agent labor
One-liner. Panout is the neutral party that measures whether a team's agent work can be trusted, proves it with signed receipts, and eventually prices that trust.
Desperate human today. The solo founder or 2-5 person team running 5-40 agent sessions a day who has already stopped reading agent output because it is impossible, and who has been burned at least once by a regression that shipped unread. They are choosing daily between "read everything" (cannot) and "read nothing and pray" (do, and get burned). The founder is this person.
Status quo and its cost. Ad hoc: git diff --stat, skim, merge. Or gstack /review + a second agent reviewing the first, with no memory of whether that review has ever caught anything. Cost: incidents, silent quality drift, and the growing dread that makes people throttle agent usage below what the tools allow.
Wedge, shippable in days. In one repo: acceptance contracts for two recurring task classes, evaluated at commit time; a terminal exception queue; each accepted outcome writes a signed receipt (what was asked, what was checked, what passed, autonomy level) into .panout/. Value on day one: you stop reading the classes that pass, and you have proof you were justified.
Why now. Agent volume per human is exploding; every harness vendor is a conflicted referee; trackers meter execution; GitHub owns the merge but not the session. Late 2026 is the first moment supported event surfaces exist for two products.
Moat mechanism (the thing that compounds). Late-binding loss labels. Panout is the only party that can join three things: pre-merge evidence (contract results, session metadata), the accepted outcome, and what happened next (revert, fix-forward, incident, or rework touching the same lines within 30 days). Harness vendors lose the thread when the session ends. Linear sees only its own cloud sessions. GitHub has no session evidence and is not neutral. The loss-labeled corpus is actuarial data: it turns "this task class has passed 40 times" into a calibrated probability of rework, per team, per task class, per execution bundle. That is what a rating agency or insurer is built on, and rating agencies are structurally winner-take-most because trust concentrates.
Why incumbents cannot follow. Anthropic, OpenAI, Cursor, Linear all run an agent; a rating of their own work is not credible. GitHub could, but its checks are mechanical, global, and blind to local sessions. An independent startup can copy the interface, not the loss history.
$1B path. Free single-repo acceptance layer -> paid team sync priced per repo -> attestation exports for audit and procurement (agent-written code provenance is becoming a SOC2 and EU AI Act questionnaire item) -> the rating: a "Panout-rated" trust level per repo, task class, and harness -> pricing risk (warranty on rated work, or enabling insurers). Comparable: Moody's, Verisk, Sigstore + Chainguard. Rating and underwriting layers on top of new labor markets have historically been the most defensible position in the stack.
Kill criteria. Day 14: founder does not answer the exception queue daily. Day 45: no task class earns autonomy without a regression. Any time: GitHub ships learned per-team review confidence joined to local session evidence.
Idea 2: Mutation-calibrated acceptance contracts
One-liner. Acceptance contracts that prove their own catch rate, so autonomy is earned statistically, not by streak.
Desperate human. The same fleet operator, specifically at the moment they ask "can I trust this check enough to stop reading?" Today the answer is a feeling.
Status quo. Tests, lint, CI, a second-agent review. Nobody knows what fraction of real faults these would catch. Streaks of green mean nothing if the checks are weak.
Wedge. Locally, off the hot path, Panout takes a sample of accepted agent diffs, injects a library of realistic agent-style faults (wrong boundary, dropped null check, swapped argument, silently swallowed error, scope creep into an unrelated file), and re-runs the team's contract. Result: a measured catch rate per contract per task class. Autonomy level requires both a clean streak and a catch rate above a threshold. Weak contracts get concrete suggestions.
Why now. Agents make the same fault classes repeatedly and cheaply; mutation testing was too expensive when humans wrote both code and tests, and is cheap when the diff is small, typed by task class, and evaluated in the background.
Moat. The fault library and catch-rate distribution across many repos. Each new repo makes the fault library more realistic. No harness vendor will publish a library of their own agents' characteristic faults.
Why incumbents cannot follow. Vendors are disincentivized to catalog their own failure modes. Mutation testing companies (Stryker, PIT) are code-centric, not task-class or agent-centric, and have no acceptance layer to feed.
$1B path. Weakest of the five as a standalone. It is a component that makes Idea 1 or 4 credible ("the product is a linter" kill criterion is defeated by measured catch rates). Standalone ceiling: dev tooling at $50-200M.
Kill criteria. Catch rates do not separate contracts (all high or all low), or background mutation runs are too slow on real repos.
Idea 3: Work receipts, the SBOM for agent labor
One-liner. A vendor-neutral, signed receipt for every unit of agent work, from intent to session to commit to PR to deploy, that anyone can verify and no vendor controls.
Desperate human. Head of Engineering at a Series B company in fintech or health going through SOC2 Type II or a large-customer security review, who has been asked "what fraction of your code is AI-generated and what controls apply?" and has no answer beyond a policy document nobody follows.
Status quo. A written policy ("all AI code is human reviewed") that is theater, plus a spreadsheet. Cost: audit findings, deal delays, or lying.
Wedge. panout attest produces, from the local ledger, a signed statement per commit or PR: which sessions, which harness, which checks passed, which human accepted. Committed as a git note or trailer. Verifiable with a public key. Days to build on the existing ledger.
Why now. EU AI Act obligations phase in through 2026-27; SOC2 questionnaires now ask about AI-generated code; SLSA and Sigstore made signed provenance normal for builds, not yet for authorship.
Moat. Format adoption plus the only cross-vendor evidence source. If the receipt format spreads the way .github/ did, Panout is the default issuer and verifier.
Why incumbents cannot follow. GitHub could issue receipts for Copilot only. Each harness can attest to itself only. Neutral, cross-harness attestation requires a party with no agent.
$1B path. Compliance infrastructure sells top-down at high prices (Vanta, Drata, Chainguard). Attestation is the artifact the enterprise budget will ask for.
Kill criteria. Auditors accept the policy document and never ask for evidence. Founder fit is poor: this is a sales-led enterprise motion with no daily use for the founder.
Idea 4: The re-litigation firewall for decisions
One-liner. Decisions are the only thing humans uniquely produce in an agent-majority team; Panout records them in the repo and stops agents from silently overriding them.
Desperate human. Any developer who has watched an agent re-introduce a dependency they removed last week, swap a chosen architecture back, or re-open a settled question. The founder's own repo has three pivots in one day documented in a log no tool reads.
Status quo. AGENTS.md and CLAUDE.md prose that agents read and forget; ADRs nobody writes; the human noticing the violation in a diff, if they read it. Cost: silent drift and repeated arguments.
Wedge. A decisions/ directory with a one-key command that turns a rejection into a decision record; an AGENTS.md section auto-maintained from it; a commit-time check that flags diffs which touch a decision's declared scope and prints only the violation. Days to build.
Why now. Every harness reads repository instruction files at session start, so a repo-native decision format needs zero integration. Agents are strong at execution and weak at knowing which past decisions bind them.
Moat. Thin alone. The decision corpus is per-repo and portable. The defensibility is in the format becoming a standard plus enforcement history feeding Idea 1.
Why incumbents cannot follow. Linear has no decision object and its graph is cloud-resident. GitHub could add one but has not in twenty years of ADR culture failing.
$1B path. Standard-first, monetized through team sync. Historically standards make big companies only when paired with a hosted service (GitHub itself). Ceiling without Idea 1: $100-300M.
Kill criteria. Decision violations are rare in practice, or agents comply from AGENTS.md prose alone, making enforcement redundant.
Idea 5: The neutral rework index across harnesses
One-liner. The only public measure of which coding agent setups produce work that survives, built from real repos, not benchmarks.
Desperate human. The engineering lead choosing among harnesses and models with a budget to justify, and the harness vendor who needs an independent number to sell against competitors.
Status quo. SWE-bench style benchmarks that vendors train against; anecdotes on X; Harness and Jellyfish dashboards that count sessions and tokens but not survival of the work.
Wedge. Consented, metadata-only export of outcome labels from Panout users; a published index by task class and execution bundle, with methodology.
Why now. Benchmarks are saturated and gamed; no neutral party has real-work outcome data across vendors.
Moat. The corpus and the methodology credibility. Vendors become customers for placement, data, and diagnostics.
Why incumbents cannot follow. Any vendor publishing this is conflicted. Entire has the richest cross-agent archive but no acceptance labels and no neutrality charter.
$1B path. Gartner or Chatbot Arena economics: vendors pay for data and standing. Requires distribution first, methodology review, and consent; long and fragile.
Kill criteria. Fewer than a few hundred repos contributing, or task selection effects too large to publish honestly.