External Signals

Four signals, one gap

Four independent forces have converged to create the conditions for a new infrastructure category. Each was documented separately, by different researchers, investors, and practitioners with no shared agenda. Together they describe a single open gap.

Four signals. Independent sources. One open gap.

AI-assisted code is producing production incidents at scale

The evidence that development velocity has outpaced integrity oversight is not a single corporate incident. It is a pattern documented by multiple independent research efforts and accelerating as AI code share increases.

The evidence

CodeRabbit (January 2026) analyzed pull requests across professional development teams and found AI-generated PRs produce 1.7 times more bugs than human-written code. Logic and correctness errors were 75% higher, adding up to 194 incidents per hundred PRs in analyzed pull requests. A separate finding from the same report: as pull requests per author increased 20% year over year through AI adoption, incidents per pull request increased 23.5%. Velocity is rising. So is the incident rate. Though causation has not been established, the correlation across the same period is consistent.

Opsera 2026 AI Coding Impact Benchmark, drawn from analysis of 250,000+ developers across 60+ enterprise organizations, found AI-generated code introduces 15–18% more defects than human-written code at scale.

a16z (April 8, 2026): Hard data on enterprise AI adoption across the Fortune 500. 29% of Fortune 500 companies are live paying customers of AI coding startups, and coding is the dominant AI use case by nearly an order of magnitude over every other category. Portfolio companies report 10–20x productivity gains from AI coding tools at their best engineers. Kimberly Tan, investing partner at a16z: code is upstream of all other enterprise AI applications because it is the core building block for any piece of software. The population experiencing the integrity gap is not theoretical. It is the single largest enterprise AI use case, documented.

Tech Monitor (April 2026): A business-risk analysis on AI-generated code documents the 2026 industry shift from coding velocity to coding quality as the binding constraint. Anthropic’s Boris Cherny, head of Claude Code, has confirmed that “pretty much 100%” of code at the company is now AI-generated. Tricentis field CTO Roman Zednik: tools can check syntax and basic security patterns, but verifying that code behaves correctly once integrated into a complex enterprise ecosystem is the harder problem, and one that manual testing capacity cannot scale to. The frontier lab has already crossed the threshold. The verification gap is what remains.

Testkube (December 2025) documented a concrete example of the failure mode Idora is designed to surface: an AI agent refactors a discount function. The code is syntactically correct, passes all tests, and looks reasonable. It silently violates a business rule: loyalty discounts cannot stack with promotional codes. That constraint existed only in code comments and team knowledge, never in formal documentation. CI passed. The violation reached production. This is not a security failure. It is a requirement conformance failure. No test catches what nobody wrote a test for.

Kyndryl (March 2026): A Kyndryl survey of enterprise technology leaders (Kyndryl sells AI governance services) found 80% had already experienced risky or non-compliant behavior from AI systems. The defining characteristic: these agents did not crash systems or generate errors. They continued functioning with apparent competence while their behavior gradually diverged from what their operators intended. The gap between intent and implementation accumulated silently.

QCon London (March 2026): Birgitta Böckeler, Distinguished Engineer for AI-assisted Software Delivery at Thoughtworks, stated that security incidents involving coding agents are now occurring weekly, with most rooted in insufficient oversight structures rather than model capability failures.

A visible case: Amazon, Q4 2025 through early 2026

Amazon experienced a series of high-profile incidents over a four-month period that brought the risk of AI-assisted code changes into broad public focus.

Amazon’s SVP of e-commerce services described this as a “trend of incidents” with “high blast radius” related to AI-assisted changes for which “best practices and safeguards are not yet fully established.” (Financial Times, March 2026)

Amazon’s response: mandatory senior engineer sign-off on AI-assisted code changes, new approval workflows for 335 Tier-1 systems, and an emergency engineering meeting in March. (eWeek; TechRadar, March 2026)

Wharton AI & Analytics Initiative (April 13, 2026): The Wharton School published a governance analysis of the Amazon incidents, framing the response — additional senior reviews, renewed human oversight — as “putting humans back in the loop after the fact” rather than closing the underlying governance gap. Top-of-field academic confirmation that the pattern is structural, not tooling.

What this means

The industry response to AI-code incidents is consistently the same: add human review, require senior sign-off, slow down. As AI code share increases (42% in 2025, projected 63%+ by 2027 per SonarSource), that response becomes a bottleneck that cancels the productivity gain.

The structural alternative: automated, continuous verification of AI-generated code against requirements, recorded as tamper-evident receipts, accumulated in a graph. The graph gives engineering teams the information to make fast, confident decisions. The decision stays with the team.

Spec-driven development is becoming the default workflow

As teams adopt AI coding agents, a methodology is emerging around how to direct them: write a structured specification first, then let the agent implement it. This is called spec-driven development (SDD), and in early 2026 it has reached critical mass.

The evidence

GitHub Spec Kit: 77,000+ stars on GitHub. Active release cadence through early 2026. Supports 22+ AI agent platforms including Claude Code, GitHub Copilot, Amazon Q, Gemini CLI, Cursor, and Windsurf. (Alex Cloudstar, March 2026; Augment Code, February 2026)

AWS Kiro: A full IDE built around SDD, launched mid-2025, built on open-source VS Code. Guides developers through Requirements, Design, and Tasks before any code is generated. Free tier available. (Kiro.dev; The New Stack, March 2026)

Tessl (2025): Raised $125 million on the thesis that specs, not code, should be the primary maintained artifact. Code is generated from the spec. The spec is the source of truth. Tessl represents the furthest end of the SDD spectrum and the clearest signal that institutional capital has validated the category.

SDD frameworks: Dozens of agentic coding frameworks have emerged around specification-driven workflows, including Spec Kit, Kiro, Tessl, OpenSpec, and BMAD-METHOD. (Augment Code, February 2026; The New Stack, March 2026)

Industry analysis: Thoughtworks, InfoQ, and Martin Fowler published deep assessments (December 2025 through January 2026). An arXiv paper (January 2026, arXiv:2602.00180) formally categorized SDD into three rigor levels. (Thoughtworks; InfoQ; The New Stack, February 2026)

Why this matters

SDD produces structured specifications as a natural part of the development workflow. Teams already have requirement documents that define what the code should do.

The critical gap in SDD today: no mainstream system continuously verifies that the generated code still conforms to the spec after subsequent changes. The agent writes code to match the spec. The code passes tests. But after 15 subsequent changes by different agents and humans, does it still conform? No system checks structurally. The spec drifts from the code without detection.

InfoQ named this gap explicitly: “Divergence is no longer an edge case; it is the natural state that must be continuously governed.” (InfoQ, January 2026)

Augment Code’s February 2026 engineering guide named the same gap from the practitioner side, describing spec-to-code verification as “the critical tooling gap” in SDD: current validation approaches rely on test-first methods rather than direct specification-to-code verification. (Augment Code, February 2026)

Compliance requirements are adding urgency. The EU AI Act high-risk obligations take effect August 2, 2026, with fines up to €35 million or 7% of global annual turnover for prohibited practices. The EU Cyber Resilience Act layers a second forcing function on top: as of September 11, 2026, manufacturers of any product with digital elements must report actively exploited vulnerabilities within 24 hours and severe incidents within 72 hours, with full notification within 14 days. Both regimes require a structural record of what was shipped, what it contained, and how it was verified. Organizations with formal AI governance structures are measurably more likely to achieve positive AI outcomes, yet fewer than one in five enterprises has mature governance for autonomous AI agents. (KPMG; Deloitte, 2026)

FTC (2026): In the United States, regulatory frameworks are establishing that companies bear full responsibility for the security and quality of code deployed in their products, regardless of whether that code was written by a human or generated by an AI agent. The principle is deployer liability: using an AI coding tool does not shift legal responsibility to the tool vendor. The enterprise carries the risk. The enterprise needs the record.

The specs exist. The verification doesn’t.

Context graphs are the next enterprise platform layer

On December 22, 2025, Foundation Capital published “AI’s Trillion-Dollar Opportunity: Context Graphs.” Within four months, the thesis went from a single VC essay to an industry-wide movement, with named companies across enterprise AI building explicitly under the context graph frame and significant VC capital flowing to the category.

The thesis

Foundation Capital partners Jaya Gupta and Ashu Garg argue that enterprise value is shifting from “systems of record” (Salesforce, Workday, SAP) to “systems of agents.” The new platform layer captures decision traces: the exceptions, overrides, precedents, and cross-system context that currently live in Slack threads and people’s heads. (Foundation Capital, December 2025)

“When startups instrument the agent orchestration layer to emit a decision trace on every run, they get something enterprises almost never have today: a structured, replayable history of how context turned into action.”

The value compounds. Every decision trace makes future decisions faster and more consistent. Starting later means permanently thinner evidence. Foundation Capital reported receiving “hundreds of pitches” within a month. (Foundation Capital, January 2026)

Foundation Capital published a follow-up in February 2026 confirming the thesis had held under scrutiny. The core argument sharpened: agents that sit in the execution path capture something enterprises have never systematically stored. “The agent layer stops being just automation and becomes the place the business goes to answer ‘why did we do that?’” (Foundation Capital, February 2026)

Market adoption

Dharmesh Shah (HubSpot) called context graphs “a system of record for decisions, not just data.” Aaron Levie (Box): “The context stuff is taking 90% of my headspace at the moment. The race to provide agents with the best context will be the defining characteristic of the winners and losers of AI over the next decade.” Arvind Jain (Glean) said: “Everyone is suddenly talking about context graphs. At Glean, we’re excited because it finally has a name.” (Foundation Capital, January and February 2026)

Companies building or claiming context graphs by April 2026:

The structural pattern

The debate is no longer whether context graphs are real. It is who captures them. Both sides agree on the architecture: domain-specific evidence, typed relationships, temporal accumulation, compounding value.

Acuvity’s January 2026 analysis went further, arguing that context graphs require tamper-resistant decision traces to function as systems of record at all. “When decision traces become precedent that shapes future behavior, how do you ensure those traces are accurate and tamper-resistant? These are the requirements that determine whether context graphs can actually function as systems of record.” Acuvity named integrity as the unsolved foundational requirement underneath the entire context graph thesis. (Acuvity, January 2026)

The pattern is domain-independent. The product is domain-specific. No company in this landscape captures integrity evidence across the software delivery lifecycle. That domain is open.

The category is being named in real time

On April 8, 2026, three independent events occurred on the same day. None were coordinated. Together they represent the clearest external confirmation the category has received.

Three independent actors named the same gap on the same day. None of them are Idora.

The consensus hardens

Within eight days of April 8, three independent analyst venues converged on the same conclusion.

Futurum 1H 2026 AI Platforms report (April 2026): “Vendor-neutral orchestration may ultimately prove more valuable than proprietary orchestration.” Enterprise survey data shows 51% of organizations pursuing hybrid multi-vendor approaches, 24.9% relying on single-vendor or off-the-shelf, and 20.1% primarily building in-house. The analyst conclusion mirrors the April 8 thesis with survey data behind it.

VentureBeat (April 14, 2026): Framed Managed Agents as an architectural shift that “turns more control over the enterprise’s AI agent deployments and operations to the model provider, potentially resulting in greater lock-in.” Session data stored in Anthropic-managed infrastructure is a feature for most customers and a structural problem for any enterprise that will eventually need agents running across Claude, GPT, Gemini, and open source.

Constellation Research; Moor Insights (April 10, 2026): Both analyst houses published commentary in Data Center Knowledge flagging lock-in and fit concerns as inherent to any single-vendor platform strategy. The larger opportunity, in both analysts’ framing, is cross-platform orchestration that no single vendor will build.

The April 8 naming was not a coincidence of three voices. It was the crystallization moment for a conclusion the market reached in days, not quarters.

Where these signals meet

The four signals are independent but they converge on a single gap:

Signal 1 (incidents) shows the cost of shipping AI-generated code without structural verification. The industry response is manual: add senior reviewers. That does not scale.

Signal 2 (SDD) shows that teams are already producing the specifications that verification would check against. The specs exist. The verification does not.

Signal 3 (context graphs) shows that the architectural pattern for capturing and compounding evidence is validated across industries. Foundation Capital and named companies including Glean, Atlan, Cycode, Interloom, and PlayerZero confirm the architecture. None have applied it to software integrity.

Signal 4 (category naming) shows that the market is converging on the same gap from multiple directions simultaneously. Anthropic, a leading seed investor, a testing platform, and hard enterprise data all pointed at the same opening on the same day. The conditions for a new infrastructure category are not emerging. They are present.

Idora sits at the intersection. It is the context graph for software integrity. It captures two evidence streams: verification receipts that check code against specifications (from Jira, markdown, Kiro, or any source), and execution receipts that observe what was built, tested, and deployed. Both are recorded as tamper-evident records in a compounding graph. The same file verified against a requirement is the file consumed by a build and shipped to production. One hop connects two evidence streams no existing tool joins.

When code moves through a pipeline without a continuous integrity layer, that information is scattered across CI logs, PR comments, and Slack threads. The graph assembles it in one place, queryable in real time.

On April 8, 2026, the convergence became visible to the market simultaneously. Anthropic confirmed the infrastructure thesis and the boundary gap in a single engineering post. A leading seed investor named the vendor-neutral layer as the category that wins. A testing platform launched with the same gap as its founding premise. The a16z hard data established that 29% of the Fortune 500 are already live in the execution layer with no integrity record connecting what their agents built to what was decided. Within eight days, independent analyst consensus hardened around the same conclusion. The signals are no longer independent. They are pointing at the same opening from four different directions, and the market is closing on the answer faster than category launches typically move.

These signals are why now.

Sources