Visual Explainers · AI code assistant Pilot

The pilot, in pictures.

Where Summit sits, how the thirty days run, what a Decision Receipt actually contains, and how a proven pilot becomes a partnership. Pair these with the interactive demo.

1 · Where Summit sits

Summit runs beside your DevOps platform. It reads consequential agent events over an outbound, read-only connection, and seals them into a signed chain. Nothing is installed into your assistant, your runners, or your repos; nothing flows inbound; no source code leaves.

CUSTOMER ENVIRONMENT AI code assistant Agent Platform Developer Flow · Fix CI/CD Pipeline Code Review · guarded merge · deploy agents act — unchanged SUMMIT (HOSTED · DEDICATED CHAIN) Rule set what counts as "consequential" itself receipted Receipt service sign → hash → chain Chain audit verify · replay control-mapping pack independently verifiable events · read-only · outbound TLS
signed / verifiable path trust boundary decision metadata only — no source code, nothing inbound

2 · How it goes in

Five phases. Each has one exit gate you can see. The first real receipt from your own flow lands in the first three days.

PRE-ENGAGE Scope + sign flow & owner named DAYS 1–3 Connect token + webhooks DAYS 4–7 Instrument rule set + dry-run DAYS 8–25 Operate proof reviews + tamper DAYS 26–30 Prove audit + pack + decide GATE first real receipt

3 · The 30 days, by owner

Who does what, week by week. Access work is deliberately yours — the DevOps platform-certified engineers running the platform steps is the implementer-enablement half of a partnership.

WEEK 1 WEEK 2 WEEK 3 WEEK 4 Summit the platform team Milestone install · rule-set workshop weekly proof reviews · verify chain live access · webhooks · token agent operates · drive the tamper test compliance lead joins first receipt escalation shown pack + decision

4 · What a Decision Receipt proves

A log says what happened. A receipt proves it — the evidence, the alternatives ruled out, the authority — and each field answers an assessor's control question.

rcpt_…telemetry_000245 ACCEPTED Action merge(!991 → release/2026.07) Actor + authority coding agent · on behalf of maria.v Evidence considered green pipeline #48214 · human approval Ruled out merge on stale approval (diff re-hashed) Prev + receipt hash …6f1c → …9ad4 (SHA-256) 3.3.2 · accountable to an actor 3.3.1 · action is auditable 3.3.3 · right events captured 3.3.8 · tampering breaks it
Illustrative receipt with synthetic values. Controls: NIST 800-171 rev. Audit & Accountability family.

5 · Implementation, end to end

Three ways to emit receipts — pick per surface, mix freely. An agent skill the agent loads, the Summit MCP server registered as an agent/Claude Code tool client, or direct REST from CI. All land in the same signed chain. Modern code assistants speak MCP and run external agents, so the integration surface is there today.

① Agent skill agent calls "prove this action" in-flow ② Summit MCP server registered as an agent / Claude Code tool ③ REST API CI job POSTs the decision directly Receipt service sign → hash → chain policy gate applied Chain audit /v1/chain/audit agent decides capture (skill/MCP/API) sign + chain verify / replay assessor
REPRESENTATIVE — exact skill name, MCP tool signatures & API schema confirmed at kickoff
① Agent skill — in the agent / Claude Code flow
// after the agent completes a consequential step
use skill: summit-decision-receipt
  action:    "merge(!991 → release/2026.07)"
  evidence:  [pipeline #48214, approval:maria.v]
  ruled_out: "merge on stale approval"
  authority: "policy R7 — guarded merge"
→ returns receipt_id + chain head
② Summit MCP server — registered as an agent/Claude Code MCP client
# .mcp.json — add Summit alongside the agent's other tools
{ "mcpServers": { "summit": {
    "url": "https://mcp.summitcognitive.ai",
    "auth": "Bearer ${SUMMIT_PILOT_TOKEN}" } } }

# the agent then calls, mid-flow:
summit_register_decision(action, evidence, authority)
summit_attach_evidence(receipt_id, artifact_refs)
③ REST API — straight from a CI job
POST https://decrec.summitcognitive.ai/v1/receipts
Authorization: Bearer $SUMMIT_PILOT_TOKEN
{ "action":"deploy: promote(release → prod-east)",
  "decision":"ESCALATED",
  "evidence":["window 08:00-18:00 ET; now 18:35"],
  "authority":"policy R9 — human auth required" }

# anyone verifies, no auth, no trust needed:
GET https://decrec.summitcognitive.ai/v1/chain/audit

6 · Pilot → partnership

The pilot is the on-ramp. Once one flow proves out, the platform team attaches receipts to assistant rollouts, compliance-bound customers get evidence they can't get anywhere else, and each delivered customer becomes the proof for the next.

Pilot proves out one flow · verified chain the platform team attaches receipts to every rollout rollout · services on top CMMC customers get assessor-ready evidence Case study + reference joint proof → next customer, faster