Daniel Meppiel, who leads go-to-market for the Agentic SDLC at Microsoft and wrote The Agentic SDLC Handbook, has published a proposal for how companies could trust code written by AI agents without reading every line. Before Microsoft he worked on distributed systems at CERN and on developer tools at GitHub and Sonar. The essay, "Agent Contracts and Receipts: toward verifiable agentic software factories", appeared on his site The AI Native Mind on November 4, 2026. It grows out of his aiDevCon NYC talk, "Version your factory, not just your code", and comes with a format specification on GitHub that he labels draft 0.1, "an invitation, not a standard".
Meppiel's starting point is a bottleneck he says enterprises keep hitting. Coding agents have made generating changes cheap, but every pull request still waits for CI to rerun everything and for a person to review it. Risk classifiers that auto-merge small changes help, he argues, but a change to how payments are approved is never low risk, and a classifier only judges the diff, not whether the system that wrote it was the one the company approved. His thesis is that trust "can't come from the model, or from reading its output" and has to come from the producing system, engineered and attested like any software supply chain.
The central unit is the Agent Contract: a single versioned file that describes one piece of agent work, in the way a job description frames a new hire. It names the inputs it needs and the files it produces, imports pinned skills, sets a budget of attempts and seconds, and lists the checks that will judge the result, fixed before the run. Contracts chain into a graph that he calls an agentic software factory, and the whole graph gets one version and one fingerprint, a digest that covers every contract, check and skill. The factory does not name a coding agent; today it runs on GitHub Copilot CLI or OpenCode.
Every completed run then leaves a receipt, a single in-toto bundle about the exact files delivered. It holds SLSA provenance naming the factory version, steps, agent, model and base commit; one in-toto test result per declared check; and an ABOM, an agent bill of materials in CycloneDX format listing the skills and packages the agent was given, each pinned by content hash. Meppiel's essay identifies two places where the usual supply chain model has to change. Agent output cannot be rebuilt byte for byte, so a separate job with no agent and no model token reruns the checks on the delivered files. And because the agent is the least trusted actor, it never signs: a pinned CI workflow it cannot reach verifies the receipt and signs it with Sigstore.
The last piece is a single required check at merge. A policy file owned by the security team, apm-policy.yml, lists approved factory fingerprints, the trusted signer, allowed skill sources and revoked skills, and repositories can tighten the organization's rules but not loosen them. The gate reads that policy from the base branch, looks up every changed file by its SHA-256 digest in the signer's attestation store, and fails anything the signed delivery does not cover. In his demonstration, a fictional bank's request to hold large wires to new payees produced a real pull request against a demo payments repository, from a factory with five contracts and eleven checks; he reports that the gate took 22 seconds.
Meppiel is explicit about the limits. A green gate says which approved factory built a change and which checks passed, not that the code is correct, so it is only as strong as the checks. No SLSA build level is claimed, models are recorded but not verified, revocation blocks new deliveries without recalling merged code, and receipts produced on a laptop are unsigned. He also notes that listing the skills an agent was given does not prove the agent followed them.
He has put code behind the proposal in two open source projects he created. APM, Microsoft's Agent Package Manager, installs factories and pins each skill to a commit and content hash under one organization-wide policy; the essay notes that Dependabot version updates now support it. APMX, which he describes as an independent and experimental implementation, runs factories on a chosen coding agent, writes the receipts and provides the gate as apmx audit. He says neither is required by the format, and asks the SLSA, in-toto and CycloneDX communities, and anyone else, to critique the draft in the GitHub discussions.