Ship · ModulePlanned (Phase 6)
Gate
A package firewall: install a release only when independent machines rebuilt the same bytes from its public source.
The problem it prevents
Installing a poisoned or swapped package: a wheel that differs from its clean git tag, assets swapped after publishing, a backdoor from the vendor's own update server.
Who it is for
Engineering orgs and CI pipelines.
How it works
- 01Point pip or npm at the ByteGuard proxy.
- 02Each release is rebuilt from its public tag by independent machines.
- 03Matching bytes are served. A mismatch is blocked.
- 04An AI agent explains the mismatch in plain words and opens an upstream fix.
What you get
- Match, mismatch or not reproducible, per package version.
- Number of independent rebuilds that agree.
- A rebuild receipt.
- A plain-words mismatch explainer.
Limits and caveats
- Starts with the top 500 PyPI packages, then npm.
- Many packages do not rebuild bit-exact today; the explainer agent exists for that.
Questions
When?
Phase 6. Payments (Phase 3) and the deterministic node (Phase 4) rank ahead of it.
Would it have caught LiteLLM 1.107.0?
The "done when" for Phase 6 is exactly that: replaying it through the proxy is blocked, with a plain-words reason.
Will it slow installs?
Matching bytes are served from cache. Only unseen releases wait for rebuilds.
Private registries?
Not in scope for the first release.