← Drag to pan the drawing →
Fifty-two checks stand between every commit and production: formal proof obligations, requirement coverage, mutation adequacy, hazard traces. The gate exits non-zero until the promises hold — no judgment calls, no “looks fine to me.”
It grades human code and agent code by the same bar. That is the point: when authorship gets cheap, the gate is what stays expensive to fool.
On jsonparser, the corpus holds 123 approved requirements. Every miss is root-caused, its siblings swept — one panic class was traced to eight sites and closed at all eight — and the class goes extinct.
Every fix becomes a permanent pin. The corpus never forgets a lesson, never rotates off the team, never needs re-onboarding. Quarter by quarter, another component joins it.
A finding is not a ticket — it is a reproducer plus an agent-ready fix prompt. Hand it to your engineers, paste it to your agents, or let our fix sprints take it. Three inlets, one gate: whoever writes the fix, the same 52 checks grade it.
The loop closes when the reproducer passes and the pin is set — not when someone says it is done.
This drawing includes our errors. One escaped defect stands on the public register: a Set() miss that slipped through with 100% MC/DC coverage at the point of escape. The postmortem is published next to the seven findings we did catch.
An assurance vendor that hides its misses is selling you the same optimism you already have. Ours are on the register, root-caused, pinned.