How is Signetry different from a SAST scanner or a normal CI check?

[bkd-dotcom]

Short version: a scanner tells you what's wrong; a CI check tells you pass/fail. Signetry decides how much authority a change earned and proves the decision.

• A SAST scanner (incl. Signetry's own signetry scan) finds vulnerabilities. That's table stakes — Signetry does it too (7 languages, cross-file taint, SARIF, 0-FP on the public benchmark).
• A CI check runs your tests and goes green/red. It has no notion of who proposed the change or how much trust it should get.
• Signetry admission wraps a change from any agent (or human) in a deterministic pipeline — executable contract → untrusted-text quarantine → required checks → independent verifier → earned authority (0/1/2) → Ed25519-signed receipt. The patch-writer never approves its own patch, and auto_merge is always false.

So it's not a replacement for review or your scanner — it's the governance layer between the agent and the human that makes the merge decision accountable and provable.

Ask follow-ups here. 👇