Muninn · an Alkhemy product
Verify the hidden context that told your AI what to change, before you merge it. Muninn catches contradictory, stale, or poisoned memory and returns a signed Context Receipt. Content-free: your code never leaves your machine.
The problem
When your AI opens a PR, you review the diff. You never see the context that told it what to change. That context decided the diff, and it is invisible at merge time.
AI coding agents act on accumulated context: memory files, retrieved snippets, prior decisions, project rules. That context drifts. It goes stale, it contradicts itself, and it gets poisoned, by accident or on purpose. The agent cannot tell. It trusts what it is given and ships accordingly.
The context says one package manager. The lockfile says another. The agent “fixes” the wrong one.
A memory note encodes a decision you reversed months ago. The agent re-introduces the bug you removed.
A retrieved snippet carries an instruction you never wrote. The agent follows it.
The fourth pillar
This is AI PR Governance. Context tooling has three pillars today: storing context, retrieving it, and delivering it to the agent. There is a fourth, missing pillar: governing that context.
Delivering context is not the same as verifying it is safe to trust. Before your agent trusts a memory, Muninn verifies it is consistent, current, and yours.
Keep context: memory files, notes, prior decisions.
Pull the relevant context when the agent asks.
Hand that context to the agent. This is where delivery tools live.
Verify context is consistent, current, and yours before the agent trusts it. The pillar the others are missing.
Delivery tools deliver context to your AI. Muninn governs it.
How it works
Muninn governs your context without ever receiving it. The server signs a typed verdict; your machine renders the evidence and never sends it upstream.
Content-free. Muninn never receives raw code, file contents, file paths, matched strings, or secrets. It receives signed, content-free signals and metadata. Verify it yourself: the payload is inspectable.
On your machine, Muninn reduces each piece of context to a signed HMAC pointer-fingerprint. No raw code, no file paths, no secrets leave the device.
The fingerprints are bundled and signed with your ed25519 key, bound to a GitHub-verified identity.
On the Cloudflare edge, Muninn evaluates the bundle against your policies for contradiction, staleness, and poisoning. It scores what it sees without ever seeing your code.
Muninn returns an ed25519-signed Context Receipt: a verdict your tooling can verify, plus an entry in a tamper-evident, hash-chained audit log.
What it catches
Your context says one package manager. Your lockfile says another. Muninn catches the contradiction before the agent acts on it.
Contradiction detection. Featured.
Reversed or aged-out decisions.
Poisoned or unattributed context.
Identity / key mismatch.
Trust & security
Precise beats absolute. Content-free, not “zero data.” The honesty is the trust.
Muninn never receives raw code, file contents, file paths, matched strings, or secrets. It receives signed, content-free signals and metadata.
A public, field-level dictionary of exactly what is received, stored, retained, and rendered. A shipped artifact, not a promise.
Public repos get summarized evidence, private repos get full evidence. The verdict is always signed; only rendered detail changes.
Every verdict is cryptographically signed and independently verifiable.
Identity is established through GitHub App installation and key-binding, not a self-asserted email.
Hash-chained. Any modification breaks the chain and is detectable.
Low latency, no data residency in a mystery datacenter.
Muninn, up close
Muninn installs as a GitHub App, sits in front of the context your agents consume, and returns verdicts your tooling can gate on. Repos, installations, keys, and verdicts. Not AI magic.
The Context Receipt is the atom of value: the proof the workflow produces. Its featured detector, policy_collision, catches contradictions before the agent acts.
Pricing
This is the launch pricing structure, not a live billing page. Paid tiers activate when the server and billing ship. Design partners are comped. Team’s advanced governance features are marked building now.
The solo dev or team lead deciding whether this is worth paying for.
The indie hacker shipping fast with Claude Code, Cursor, Codex, or Copilot.
Small teams and platform leads adopting AI responsibly.