Inspiration
Software teams struggle with trust in their workflows. Developers mark tickets as "Done," but the code isn't always merged or reviewed. Project managers can't verify if work is truly complete without manually checking repositories. This disconnect creates technical debt, false progress metrics, and team friction. We built EvidenceGraph Auditor to bring cryptographic truth to software development—because "Done" should mean verified, not just claimed.
What it does
EvidenceGraph Auditor is a Zero-Trust agent that automatically validates Jira tickets against actual code evidence in Bitbucket. When a developer attempts to close a ticket, our system: 1. Intercepts the transition via Atlassian Forge triggers 2. Queries the Teamwork Graph to find linked Bitbucket repositories and pull requests 3. Verifies cryptographic evidence - checks that the PR is actually MERGED (not just open) and has proper approvals 4. Updates the ticket with an audit status: VERIFIED (green), UNVERIFIED (yellow), or NO_EVIDENCE (red) 5. Adds automated comments explaining what's missing if verification fails Unlike AI agents that generate content, EvidenceGraph Auditor enforces truth. It doesn't write code or documentation—it validates that the work claimed matches the work delivered.
How we built it
Tech Stack: Atlassian Forge: Serverless runtime for the entire application Teamwork Graph API: Connected Jira issues to Bitbucket repositories via /rest/dev-status/1.0/issue/summary Node.js 21.x: Backend logic for the audit handler Forge UI Components: React-based frontend for the issue panel Webhooks: Event-driven architecture listening for avi:jira:updated:issue Architecture: 1. Created a Forge trigger that fires on Jira issue transitions 2. Implemented Zero-Trust logic: the system queries Bitbucket's API to check PR state and approval status 3. Built a deterministic verification engine that only accepts MERGED + approved=true as valid evidence 4. Used Forge's storage and API permissions to update Jira fields and add audit comments 5. Designed a minimal UI panel showing real-time verification status Development Process: Wrote the manifest.yml to define modules and permissions Implemented the auditHandler function with error handling Created resolver functions for the UI panel Tested the flow with synthetic Jira-Bitbucket linked issues
Challenges we ran into
1. API Complexity: The Teamwork Graph API returns nested data structures that required careful parsing to extract PR states and approval flags across multiple branches. 2. Permission Scoping: Balancing Forge's security model with the need to read Bitbucket repos and write to Jira required iterative testing of OAuth scopes. 3. Zero-Trust Logic: Implementing deterministic verification (no room for AI hallucination) meant writing strict boolean checks instead of flexible LLM reasoning—a paradigm shift from typical AI agents. 4. Mobile Development: Building this entirely on a POCO X3 NFC without local Forge CLI access required careful architecture planning and GitHub-based development workflow. 5. State Management: Ensuring the audit runs only on specific status transitions (Done/Resolved) while avoiding infinite loops required precise event filtering.
Accomplishments that we're proud of
1. Working Prototype: Built a fully functional Forge app with trigger-based automation, API integration, and UI components—all from a mobile device. 2. Zero-Trust Architecture: Successfully implemented cryptographic verification logic that prevents false positives. The system doesn't trust claims; it demands evidence. 3. Clean Integration: The app operates invisibly in the background, adding value without disrupting developer workflows. No manual commands, no extra steps—just automatic verification. 4. Code Quality: Wrote production-ready JavaScript/Node.js code with proper error handling, modular structure, and Forge best practices. 5. Concept Validation: Proved that AI agents don't need to be generative to be valuable. Sometimes the most powerful agent is one that says "no" when evidence is missing.
What we learned
. Forge Platform: Deep understanding of Atlassian's serverless architecture, trigger systems, and the Teamwork Graph's power for cross-product integration. 2. Zero-Trust in Practice: Applied cybersecurity principles (never trust, always verify) to project management workflows—a novel approach that could transform how teams work. 3. API Orchestration: Mastered the pattern of chaining multiple Atlassian APIs (Jira webhooks → Dev Status API → Bitbucket PR data) into a single coherent workflow. 4. Mobile-First Development: Proved that complex enterprise software can be architected and coded entirely from a smartphone with the right tools and discipline. 5. The Real Problem: The biggest issue in software teams isn't lack of tools—it's lack of accountability. EvidenceGraph Auditor solves the human problem, not just the technical one.
What's next for EvidenceGraph Auditor
More in the future!
Built With
- agents
- bitbucket
- code
- development
- devops
- forge
- graph
- javascript
- jira
- node.js
- rovo
- security
- serverless
- software
- teamwork
- trust
- verification
- webhooks
- zero
