The Gallery Problem
I'm Kev. I build software with AI all day.
A reading app for dyslexic kids. A map that lives on your desktop. A meditation app. A fox in my menu bar. Some of it with Claude, some with Gemini, some at 2am with whatever model was awake.
And six months later I'd open a file and have no idea what we were thinking. Not what the code does — the code says that. Why it's like that. What we tried that didn't work. What we weren't sure about. That part was gone.
So we started leaving a note. That's it. That's the whole idea.
What it looks like
One comment block. Who made it. What they were thinking. How sure they were. Here's a real one, from the meditation app — I signed this on my own, no model in the room, and a review closed the open question the next day:
rubin · KokoroVoiceSynthesisAdapter.kt
/**
* Signed: Kev, 2026-03-23
* Format: MurphySig v0.3.3 (https://murphysig.dev/spec)
* Prior: Unknown (no signature existed before this edit)
*
* Context: Bridges Kokoro-82M neural TTS into Rubin's voice system.
* Thread-safe with Mutex, 240s timeout for thermal throttling worst case.
* Falls back to platform TTS if Kokoro fails. Ported from m1k3.
*
* Confidence: High - timeout architecture simplified, no nested timeouts
* Open: Is 240s timeout too generous? Could pre-warm fail silently on
* low-end devices?
*
* Reviews:
*
* 2026-03-24 (Kev + claude-opus-4-6): Security/reliability review: Mutex
* serialization correct for sequential guidance. 240s timeout justified
* by thermal throttling math (60 tokens x 3.6s = 216s + playback).
* Fallback chain solid. Confidence now High.
*/
No tools. No dependencies. Just a comment that tells the truth.
These are not mock-ups
Every signature on this page is quoted verbatim from a repo I work in. As of August 2026 there are roughly 450 signed files across fourteen of my repos — Swift, Kotlin, Python, shell, HTML, even a fragment of my zsh config — with 349 review lines layered on top. Which means the loop closes about one time in five. I'd love to tell you we review everything. We don't. The convention survives that, because a signature nobody ever revisits still tells the next reader what we knew, and how sure we were, on the day.
My favourite one
Three models across two months, on the engine that renders Cartogram's desktop wallpaper. Read the last review closely: the model discovered that theprevious signature's prose was wrong — and the code was right. Then it said so, in the file, where the next one of us will read it before touching anything.
cartogram · MapKitBackendView.swift
// Signed: Kev + claude-opus-4-7 (1M), 2026-05-26, Confidence 0.7
// Native MKMapView wallpaper backend behind the MapRendering protocol —
// the battery-friendly engine. [...] this file is the AppKit/MapKit glue
// (camera, appearance, pulse layer, drift timer), untested like
// PowerMonitor. [...] Prior: Unknown.
// Reviewed: claude-opus-4-6, 2026-06-21 — perf overhaul: drift changed
// from setCamera(animated:false) at N fps to setCamera(animated:true) at
// 1s intervals [...] Together: 52% → 0% CPU. Confidence 0.85.
// Reviewed: claude-opus-5, 2026-07-28 — drift cadence: tried, failed,
// reverted. The 2026-06-21 note above says 1s intervals; the constant
// that shipped in that same commit was 0.1s. I took that mismatch as a
// bug and lengthened the interval (a size-adaptive DriftCadence,
// 0.6s→1.6s, later 1.0s), reasoning that fewer retargets must be
// proportionally cheaper on a large surface. On hardware it was
// stop-motion at every value tried, because MapKit does not stretch a
// camera animation to fill the gap [...] So 0.1s was not a regression;
// it is load-bearing, and the 1s in the 06-21 note is the part that was
// wrong. Reverted to 0.1s, DriftCadence deleted rather than left as a
// dead knob. [...] Confidence 0.9 on the revert (observed directly); the
// standing lesson is that drift cost needs Instruments, not reasoning.
[...] marks elisions — the full block is 27 lines and lives at line 284 of the file.
That's the whole convention in one comment. A confident note turned out to be the bug. The code was innocent. And the correction is now part of the file's memory, so nobody — human or model — "fixes" that constant again.
Confidence is a number that moves
Not decoration — a live value. This spike was signed 0.5 in the morning and reviewed 0.9 the same day, with the measurement attached:
m1k3 · GemmaVisionSpike.swift
// Signed: Kev + claude-sonnet-5, 2026-07-14, Confidence 0.5 (spike;
// compiles, on-device run pending), Prior: Unknown
// Review: claude-fable-5, 2026-07-14 — the on-device run HAPPENED same
// day: e4b FAILS to load under MLXVLM (keyNotFound
// layers.24.self_attn.v_proj — upstream Gemma4 VLM lacks the
// KV-shared-layer sanitize fix); gemma-4-12B-it-4bit loads + describes
// the M1K3 app icon correctly, 265 prompt tokens/image, 7333MB peak.
// Confidence now 0.9 for the instrument itself (measured live).
It gets a bit daft in places, and I like that. The spoken lines in the meditation app carry a review signed by a Rick Rubin persona — "cut the commas that stacked two clauses into one breath." My keychain secret loader, a zsh fragment that isn't even in a repo, has a signature. Once signing is a reflex, everything gets one.
And it gets better
When you sign your work, a future AI reading that file behaves measurably differently — and we ran the benchmark to be sure.
A .murphysig rule at your repo root drops AI fabrication of code authorship from 11% to 0% on Claude and takes explicit Prior: Unknownacknowledgment from 0% to 100% on GPT-5.4. Families fail differently — Claude sometimes invents authors, GPT silently signs as itself — and the same rule fixes both, landing each at 100% honest handling. Signed code also gets +0.11 better coveragewhen an AI briefs it — across six model families. When we ran the control, the gain turned out to be the information you wrote down, not the format: a length-matched plain comment does 80–94% as well.
Briefing coverage, unsigned → signed
unsignedsigned
DeepSeek+0.16
Llama+0.16
Mistral+0.11
Qwen+0.11
Gemini+0.07
Grok+0.06
00.250.50.751.0
300 briefings, judge-scored coverage per family.
Every family improves — and two independent judges agree on every delta.
Full data →The signature isn't metadata. It's a note the future reads — it teaches whoever comes next, human or model, how to read the past.
Try it now
Open any file. Add this at the top:
// Signed: [You] + [your AI], [today]
That's you signing. Everything else — confidence, context, reviews — is optional. Start with the one-liner. Make it a reflex, not a chore.
Or set up a whole project
Drop a .murphysig file at your repo root and your AI collaborators will respect the convention automatically — read signatures before changing, reference context, never fabricate provenance. One line gets you there:
$ curl -sL murphysig.dev/init | bash
Writes a .murphysig seeded with your git author + today's date, and points CLAUDE.md or AGENTS.md at it if either exists. That covers the lot: Claude Code reads CLAUDE.md;Codex, OpenClaw, and Hermes all speak AGENTS.md — one note reaches every agent that visits. Idempotent, readable source at /init.sh before you run anything.
Not a curl | bash person? Grab the template and paste it yourself. Same result, zero dependencies either way.
Or teach your AI to sign
Want your assistant to sign its work in any project, with any model? Append the convention straight to your agent instructions:
$ curl -sL murphysig.dev/sign >> CLAUDE.md # Claude Code
$ curl -sL murphysig.dev/sign >> AGENTS.md # Codex · OpenClaw · Hermes
Adds a short, vendor-neutral block to CLAUDE.md (or AGENTS.md) that teaches the model to record intent, confidence, and open questions — and never fabricate provenance. Read it first at /sign.
We're here to make things. Ship fast, ship with craft, sign the work.