Ledgerful — Local-First Code Change Risk Analysis

Install<br>Understand code change risk before it ships. Runs locally.<br>Ledgerful analyzes Git repositories locally and produces risk, provenance, verification, and SOC 2-style evidence without uploading source code by default.<br>Install LedgerfulCopy<br>See how it worksv0.2.3 with SHA-256 checksums, SBOM, and cosign signing. Public — see release notes.

What Ledgerful does<br>Four capabilities, all running on your machine. Nothing uploads by default.

Track every change<br>On commit, Ledgerful writes a signed, tamper-evident record of what changed and why — an audit trail for code inside the normal git workflow.<br>Signed record on commit<br>Tamper-evident audit trail<br>Git-integrated workflow

Assess risk<br>Before a commit, Ledgerful analyzes the blast radius of a change — affected files, which tests to run, risk level, and complexity hotspots.<br>Blast radius analysis<br>Affected files<br>Tests to run<br>Complexity hotspots

Prove what happened<br>Ledgerful generates offline-verifiable evidence — signed ledger entries and a SOC 2-style evidence export — that an auditor can check without trusting anyone's word.<br>Signed ledger<br>SOC 2-style export<br>Offline-verifiable chain-of-custody

Ask your codebase<br>Ledgerful builds a local knowledge graph of the codebase and answers plain-English questions grounded in the actual code.<br>Local knowledge graph<br>Plain-English queries<br>Route and function mapping<br>Ask is local-model-capable (Ollama). Any cloud model (Gemini/OpenRouter) is strictly opt-in and user-configured — nothing uploads by default.

Sample signed receipt

tx_id: e09f48ab-0afe-4881-833f-8fd80048ea34category: BUGFIXentity: src/invoice.rschange_type: Modifysummary: fix(invoice): [DEMO] fix rounding error in tax calculationreason: Switch tax calculation from f64 to Decimal to eliminate floating-point rounding.committed_at: 2026-07-14T01:47:02.876335722+00:00signed: yessignature: f3e27176…39807Signed provenance record — one row from the verified sample-soc2 exportledger.csv — signed entry

Proof points, linked to evidence<br>Deterministic outputs<br>Same repo, same state, same risk score.

Signed ledger provenance<br>Ed25519 signatures verified offline.

Verification plan per commit<br>Build and test steps planned automatically.

Release workflow emits companion checksums<br>SHA-256 + cosign + SLSA per release.

The volume of change has outpaced the evidence for it.<br>More commits, more repositories, more evidence rebuilt after the fact.

More change, reviewed the same way<br>AI-assisted commits keep raising the volume of change a team produces, while most of it still gets the same diff-sized review it always did.

Risk spreads across repositories<br>Once work spans more than one repository, risk collects across all of them at once — and no single diff view shows that picture.

Evidence gets reconstructed after the fact<br>When an audit or incident review happens, evidence is usually rebuilt afterward from commit messages and memory, instead of captured at the time of the change.

What a scan actually produces<br>Each output is a captured artifact from a real v0.1.9 run.

Risk summary<br>Local dashboard receipthttp://127.0.0.1:52001/dashboard<br>Verification plan

Verification Plan Source: Auto-Policy Runner: cargo test • Check for whitespace errors in staging area • Check for whitespace errors in working tree • Run buildVerification Steps: • git diff --cached --check (timeout: 400s) • git diff --check (timeout: 400s) • npm run build (timeout: 400s)Dry run mode: verification plan displayed above. No commands were executed.Verification plan — sample-repo capture (command shape current through v0.1.9)ledgerful verify --dry-run

Evidence export

{ "generatedAt": "2026-07-14T01:47:02.982622805+00:00", "files": [ { "name": "chain_head.json", "sha256": "3a0555a3cdc06156530aaff441232247bae2c105ea7c199b8c9a77f836cba68f", "size": 431 }, { "name": "ledger.csv", "sha256": "25ca4a8d…2927b63", "size": 3266 }, { "name": "verification_history.csv", "sha256": "56ef6d6a…6ed0e84", "size": 57 } ], "entryCount": 7}Evidence export manifest — tamper-evidence hashes, sample-soc2 exportmanifest.json

What's available today<br>Local CLI, dashboard, signed provenance, and SOC 2-style evidence export are implemented now. Team sync is beta. Hosted and enterprise features are planned — see the full breakdown on the editions page.

Local by default<br>The engine, ledger, and dashboard run on your machine. Hosted sync is planned, not live — see the architecture page and the trust page.

ledgerful 0.1.9Binary version — captured from v0.1.9ledgerful --version

Ledgerful Doctor - Environment Health Check==================================================Environment: WslActive Shell: UnknownLEDGERFUL_PLATFORM: os=linux, arch=x86_64, family=unix, target_triple=x86_64-unknown-linux-gnuTools: git Found (/usr/bin/git) gemini NOT FOUNDCurrent Path: /tmp/neutral-repoPath Type: NativeActive Ask Backend: Local (127.0.0.1)Embedding Model: Not configuredCompletion Model: Not configuredNative...