Source: docs/research/2026-09-03-defensibility/rounds/r2-memo.md

Panout defensibility, round 2 (2026-09-03): The clearance layer for agent labor

One sharpened idea, replacing the five in round 1. Round 1's judge scored the best single idea 62 and the best combination 72, with three objections: no external demand evidence, a loss-label moat half-owned by GitHub, and a $1B path routed through prosumer conversion and enterprise sales. This round answers each with a mechanism or a measurement, not an argument.

The two sentences

Moat. Panout sits at the only boundary where agent work that a human rejected can be seen: the local commit boundary, before GitHub, Linear, or the harness vendor ever learns it existed. GitHub sees only survivors; vendors see only their own agent; Panout is the sole holder of each team's rejections, and rejections are what calibrate trust.

$1B. Every unit of agent labor needs a clearance decision, humans cannot make them by reading, and the party that clears them is paid per decision, so revenue scales with agent volume rather than human seats. Stripe Radar for software labor: per-transaction pricing on a cross-customer trust model that gets better with every customer.

One-liner

Panout clears agent work. It learns each team's accept and reject bar from what they already do, enforces earned autonomy per task class in the repo, and charges only for the reads it saves.

The constraint set (unchanged, all respected)

Does not control agents. Never in the live agent loop (evaluates at commit, PR, and session-end boundaries). No login, repo and terminal only. No duplicate runs. Raw content stays local; the ledger holds metadata, hashes, contract results, and labels.

The desperate human, named as precisely as the data allows

The founder, measured (git-only backtest, 2026-09-03, appendix A). 245 Claude Code sessions in 30 days on one machine, plus Codex. Across 11 founder-controlled repos over 180 days, 64% of commits are agent-authored; in the repos the founder builds alone the share runs from 27% (dotfiles) to 63% (a gateway service). 99% of agent commits land directly on the default branch with no merge commit. Agent commits are reworked within 30 days at 65%, versus 49% for human commits; restricted to commits the founder personally authored, 60% versus 38%. One in six reworked agent commits is reworked by the very next commit. Explicit reverts are 0.16% of commits: correction shows up as rework, not revert, which means it is invisible to anyone counting reverts. This is a person who has already crossed into merging unread and is paying for it in a form no existing tool measures.

The cohort, observed in public (appendix B, measured 2026-09-03 against the GitHub API). 1.5 million merged PRs from Copilot's coding agent, 5.8 million merged PRs on Codex branches, 694 thousand on Cursor branches, 346 thousand carrying a Claude co-author trailer. In a 150-PR sample of merged Copilot agent PRs, the median time from open to merge is 1.3 minutes and 70% merge within 10 minutes, at a mean of 397 added lines; the control sample of non-agent PRs in popular repos merges at a 25-minute median. Zero-review merge rates are not distinctive (49% for the control), so the claim is not "agents get merged without review", it is "agent output is merged faster than it can be read, into a review culture that was already thin." Sonar's 1,100-developer survey: 96% believe AI code is not reliably correct and 48% say they always check it. Peter Steinberger, publicly: "I don't read much code anymore."

The named consequence. Amazon, March 2026: a "trend of incidents" with "high blast radius" tied to "Gen-AI assisted changes", a roughly six-hour retail outage, and a remediation that is the whole problem in one sentence: every AI-assisted change must now be approved by a senior engineer before deployment, which Amazon called "controlled friction." That is the status quo's only answer to agent-caused incidents: more human reading, applied to everything, forever. The person who needs Panout is the engineering leader who has just been told to read everything and knows it cannot scale, and the fleet operator one incident away from the same order. DORA 2025 (about 5,000 respondents) finds AI adoption at 90% and continuing to increase change failure and rework; GitClear measures code churn rising from a 3.3% pre-AI baseline to 7.1% in 2025.

What gets them promoted or fired. Shipping volume without incidents. The lever they control is how much agent output they read, and today that lever has two positions: everything, or nothing.

Status quo and its cost

Position A, read everything: caps agent throughput at human reading speed. The two team repos in the backtest merge roughly 2,500 agent commits a month each, 85% of all commits; nobody is reading that. Position B, read nothing: git diff --stat, skim, merge. Cost is the measured rework gap: agent work reworked within 30 days 15 to 22 points more often than human work in the same repos, with the correction landing a median 17 hours later. Industry-wide the same signal shows as churn doubling (GitClear) and instability rising with adoption (DORA 2025), and Veracode finds models pick the insecure implementation in 45% of tasks with no improvement across model generations. Position C, second-agent review (gstack /review, Cursor Bugbot at $1 to $1.50 per run, Copilot review, Codex review): a reviewer with no memory of the team's bar and no record of whether it has ever caught anything. It produces more text to read, which is the problem restated. Bugbot's shift to per-review pricing in June 2026 is also the market telling us that per-unit pricing at this boundary is accepted.

Verified against vendor documentation on 2026-09-03 (appendix B): across Copilot code review, GitHub rulesets and merge queue, Linear Coding Sessions and Guided Reviews, Cursor Bugbot, Claude Code hooks and OpenTelemetry, and Codex review, none learns a per-team acceptance bar from history, none enforces autonomy per task class, and none records rejected or discarded agent work as a first-class artifact. The closest approximations are hand-written rules files and effort dials.

None of these learn. Every day of agent work today produces zero durable information about what this team accepts.

The wedge: zero new behavior, 48 hours

Panout's v1 died because it required the founder to read an inbox. This wedge requires nothing new; it instruments behavior that already happens.

1. panout init adds a commit-time evaluation to the repo. Two acceptance contracts for the two task classes the founder repeats weekly (derived from the existing AGENTS.md and test setup). Output: only failures, with evidence, printed where the commit happens.
2. Rejections are captured, not requested. Sources already on disk with supported schemas: harness logs recording a human rejecting or interrupting an agent action (26 rejections and 27 interrupts in 30 days on this machine across 245 Claude Code sessions, plus Codex denial events), agent-produced diffs discarded via reset, checkout, or stash before commit, and commits reverted or reworked within 30 days. No transcript content is read; only event type, timestamp, file paths, and diff hashes.
3. Acceptance is the commit. Committing after a printed failure is an override and is recorded as one. Nothing to click, nothing to log into.
4. One optional key: turn a rejection into a decision record in decisions/, auto-summarized into AGENTS.md so every harness reads it at session start.

Day-one value: the founder sees only failures. Day-fourteen value: the first task class reaches autonomy level 1 and its passing commits are no longer surfaced at all. The test is binary and requires no new habit: does the founder keep committing with the check on, and does the surfaced count fall?

The moat, in three layers that GitHub cannot copy

Layer 1: the rejection corpus (survivorship). GitHub, Linear, and every analytics vendor compute quality from what was merged. That is a dataset of survivors. A rating built on survivors cannot calibrate: it never sees the negative class. Panout observes the negative class at the only place it exists, the local boundary, and the negative class is not reconstructible later. Git can be re-mined in five years; a rejected diff that was never committed is gone unless something recorded it. This is the asymmetry the round 1 judge asked for: the post-merge half of the label is public, the pre-commit half is Panout's alone, and it is the half that carries the information.

Layer 2: earned autonomy as the team's calibrated policy. Each task class carries a level from 0 (human reads everything) to 4 (auto-merge). Levels are computed from acceptance streaks, rejection history, and contract catch rate (see calibration below), and enforced at the merge boundary. This is the switching cost: leave Panout and you go back to reading everything, because the policy is derived from a history no other party holds. It also answers "what happens when GitHub ships AI review confidence": GitHub's confidence becomes one more evidence input to the contract, the way a CI check is. GitHub's signal is global and mechanical; the policy is the team's.

Layer 3: cross-team priors (the Radar effect). Each team's bar is private. What is shared, with consent and as aggregates, is the pattern library: which fault classes get rejected, which contract shapes catch them, and which task signatures earn autonomy fastest. A new team's contracts start warm. This is why one merchant's fraud history is worthless and Stripe Radar's is a business: the per-customer data is thin, the cross-customer prior is thick, and no customer can get the prior without joining. Neither a harness vendor (sees one agent) nor GitHub (sees no rejections) can build this prior.

Calibration, so the moat is measurable and the product is not a linter. Off the hot path, Panout injects a small library of agent-characteristic faults into a sample of accepted diffs and re-runs the contract, producing a catch rate per contract. Autonomy requires both a clean streak and a catch rate above threshold. Weak contracts cannot earn autonomy. This converts the round 1 day-45 kill criterion ("contracts are theater") from a risk into a metric that is measured weekly.

Incumbent response, and why the idea survives each

Business model: pay only for reads avoided

• Free: level 0 everywhere, unlimited repos, unlimited agents, forever. Recording and the exception queue cost nothing. Distribution comes from the free tier being the best way to see what your agents did.
• Metered: a small fee per outcome cleared at autonomy level 1 or above, i.e., per read Panout saved. A team pays nothing until Panout has earned the right to hide something from them, and then pays only in proportion to the reading it no longer does. No per-seat pricing, no per-token pricing, ever, as a charter commitment.
• Teams: flat per-repo tier for shared policy, sync, and permissions, for buyers who want predictable bills.
• Named, not built: attestation exports for audit, and diagnostic reports sold to harness vendors about their own agent's clearance rate on consenting teams. Timing note from the evidence: as of September 2026 no auditor, framework, or standard questionnaire asks for the AI-authored share of code, and EU AI Act Article 50 duties fall on model providers, not teams. Attestation is a 2027-28 budget. It is not in this plan's revenue.

Why this fixes the round 1 objection. Revenue tracks agent volume. A team of two humans and forty agents pays Linear $32 a month; the same team clears thousands of outcomes a month. At a nominal fee per cleared outcome, an active small team is worth hundreds of dollars a month with no seat expansion, and the count grows every time the models get better and the team lets them do more. Prosumer conversion rates are irrelevant when the meter is on the agents.

$1B math, stated plainly. Cumulative merged agent PRs visible on public GitHub alone already exceed eight million across Codex, Copilot, Cursor, Claude, Devin, and Jules; Claude Code is estimated at about 4% of public commits with a projection above 20% by year end (secondary source, unverified). Cursor has 50,000 paying teams and passed $2B annualized revenue in March 2026, so the buyer population that already pays for agents at team scale is measured, not imagined. A team clearing 500 outcomes a month at a fee of roughly a third of a dollar pays about $2,000 a year; 50,000 such teams is $100M in annual revenue, and every model improvement raises the cleared count because teams let agents do more. Trust infrastructure trades at the multiples that make that a $1B company: Chainguard raised at $3.5B on $40M of revenue growing seven-fold, LMArena at $1.7B four months after its first product, Stripe Radar built a network business on a five-cent screening fee. Comparables are for the shape of the business, not the market.

Why now, and why not in 2028

Supported event surfaces (Claude Code hooks and OpenTelemetry, Codex OpenTelemetry) exist as of this year, so rejections are observable without private parsing. Agent volume per human is crossing the point where reading everything is impossible. Every incumbent has just committed to a position that disqualifies it as referee: GitHub to Copilot, Linear to hosted execution, vendors to their own agents. In 2028 the rejection corpora will exist somewhere; the question is whether they sit in one neutral place or are lost inside six vendors' logs.

Founder fit

Repo and terminal only. Zero new habits: the behavior the product instruments is committing, rejecting, and writing decisions, all of which the founder does daily and prolifically. Solo-buildable in the runway: the ledger and commit-time evaluation exist as a spike; the wedge is two contracts and a rejection adapter.

Plan against five months, with kill criteria

• Days 1 to 14. Wedge above, in this repo and one other. The git-only rework baseline is done (appendix A); the next measurement is whether local evidence (rejections, interrupts, contract results) predicts rework better than git alone, on the same commits. Kill if the founder stops committing with the check on, or the surfaced count does not fall.
• Days 15 to 45. Autonomy levels enforced pre-merge; Codex as second harness; ten-fault calibration spike. Kill if no task class earns level 1 with zero regressions, or if catch rates do not separate contracts.
• Days 45 to 90. Three external fleet operators from the watering hole running it, with rejection capture on. Publish the first number nobody has: the rejection rate of agent work by task class, across harnesses. Kill if fewer than two operators keep the check on for 14 days.
• Month 4 to 5. Continue only with external teams paying the meter or a fundable signal.

Evidence appendices

• Appendix A, local git backtest: /tmp/panout-ideas/appendix-a-backtest.md (method, per-repo tables, caveats; git-only, rework is a proxy).
• Appendix B, public evidence with URLs: /tmp/panout-ideas/evidence-public.md (GitHub API measurements reproducible via gh, incident sources, DORA, GitClear, Veracode, vendor documentation for each incumbent, comparables; items the sweep could not verify are marked UNVERIFIED and are not relied on above except where labeled).

What the evidence does not show, stated so nobody has to discover it. No external human has used Panout. Zero-review merge rates do not distinguish agent PRs from human PRs in popular repos; the distinguishing signal is merge latency. Nobody is asking for AI-code provenance yet. The rework measurement is line-identity, not semantics, and the founder's largest repos are team repos where the founder is a minority committer.