Loading…
One record. One scar.
The day the green suite lied
Read it the way you read it the first time — when every line still looked like progress.
Nothing in that record was false. The suite really did pass — and that is the trap. A passing suite reports that the code ran, not that it is reached, and not that anyone independently checked it did the job it was merged to do.
A green suite told you it was done. It was not.
Not a new tool — a control plane
One control plane over the stack you already run.
Every tool below is proven, and already in your delivery. None of them is the product. The product is the pre-built, pre-configured assembly that makes them behave like one production-safe system, governed by fail-closed gates.
One governed control plane — the proven tools you already run, pre-wired into a single closed loop
- Claude Codecoding agent
- GitHubsource + rulesets
- GitHub ActionsCI runners
- Playwrightend-to-end tests
- Semgrepsecurity scanning
- OPA / Conftestpolicy gates
- OpenTelemetryexecution traces
- Langfuseagent observability
- Neondurable memory
Outside the engineTemporaldurable orchestration
The loop runs on durable orchestration it doesn’t absorb. Showing the seam is the honest version — the engine doesn’t pretend to replace the ground it stands on.
Mechanically: a Stop hook, an OPA/Conftest policy, and a GitHub ruleset decide over a feature_list.json whose every item stays unproven until evidence lands.
Why now: Deterministic per-edit enforcement only became possible recently — command-type hooks that fail closed.
Before / after
You used to steer every edit. Now the gate does.
Same agent, same tools. What changes is who does the proving — you, by hand, or the loop, on every edit.
Implement(payment_retry.ts)
guard added · suite green ✓
is it actually wired into the live path?
grep -rn retryGuard src/ | grep dispatch
(no matches)
it compiles. it never runs. re-check by hand — again.
Edit(payment_retry.ts)
[PreToolUse] scope-gate → within bounds
done — suite green ✓
[Stop] evidence-gate → HELD: unproven
wired-path check never ran → routed to HANDOFF
That is literally my job, gone
Every unpaid role you became, the engine takes back.
You did not sign up to be the agent’s missing parts. Each role you quietly absorbed is displaced — outcome first, then the mechanism that does the displacing.
The role you becameWhat the engine does instead
You are its memory.
The requirement survives the context cut-off — it is carried, not re-introduced by you.
session-state hook re-grounds each edit against the standing requirement
You are its verifier.
Whether the code was wired into a live execution path is checked before it merges, not by hand afterward.
PreToolUse + Stop hooks check the edit against the requirement, fail closed
You are its scope-enforcer.
An edit cannot wander past the change it was asked to make.
isolated worktrees plus scope-sequencing bound each task to its own surface
You are its auditor.
What the agent claimed, and whether it was independently confirmed, is recorded as it happens.
PreToolUse + Stop hooks emit the four-field evidence record per edit
You are its integration-lead.
Work that meets the bar reaches done; work that does not routes to handoff instead of merging quietly.
gate chain — Stop, OPA/Conftest, GitHub ruleset — splits done from handoff
You are its tool-selector.
The right capability is chosen against the task, not guessed by you under deadline.
capability routing matches each task to its enforced tool surface
The engine removes the unpaid roles it can deterministically enforce. Judgment about what the work is for stays with you; orchestration runs outside the per-edit engine.
The climax — first green
The line is held.
The loop runs to the gate — a GitHub ruleset it can’t talk its way past. An unproven item does not merge, and that is the most reassuring thing on the page. A block, here, is a win.
- evidence-gatespec-to-evidenceHeld — 1 item unproven — routed to handoffRequired
- buildGitHub ActionsPassed — compiled and packaged
- policyOPA / ConftestPassed — zero-evidence policy passedRequired
- e2ePlaywrightPassed — ran in a live path
Merge blockedThe held item awaits evidence — it routes to a human, not a quiet merge.
The question you answer yourself
Could an auditor prove your agent did what it claimed?
Or closer to home: could you, six months from now, prove which requirement this code satisfied — and that it was ever independently verified?
The leap is a trade you can read at a glance: you hand the proving work to the engine, and what you get back is delivery that carries its own evidence.
Jobs you stop doing
Carried today by you, by hand- manual tool-selection
- manual context-management
- manual micro-steering
- manual traceability
Guarantees you gain
Returned by the engine, on every delivery- every change leaves a record
- untested code cannot ship
- each change tied to its requirement
Where “looks done” is unacceptable
When an auditor asks what the agent did, a self-report is not an answer.
Some fields cannot accept a passing test suite as proof. In them, the person who signs off carries the liability when “it compiled” turns out not to mean “it was proven.” This is built for exactly that reader.
Aerospace
every change traced to the requirement it satisfies, before it flies
Medical devices
software must show what it was verified against
Finance
a control has an independent evidence trail, or it does not exist
Defense
a launch cannot wait on someone’s word that it works
Customer evidence will appear here. Until then, none. We would rather show an empty frame than borrow conviction we have not earned.
Your evidence is portable: an open four-field record and requirement-ID tags, not a proprietary cage.
Already solved, never assembled
The missing piece was never a cleverer agent. It was a way to prove the work — automatically, on every edit.
This is not a new model or a cleverer prompt. It is an assembly of parts you already trust, wired into one loop: the agent does the work, and the same loop forces it to leave evidence that it did.
Why nobody did this
The pieces existed; the enabling primitive did not. Deterministic per-edit enforcement only became possible recently — command-type hooks that fail closed. Once a single edit could be held the instant it was unproven, the loop could finally assemble. We are honest about the seam: durable orchestration still runs on Temporal, outside the engine, not pretending to be part of it.
Not ready to dig in? Get notified when we open the platform. No date we can promise yet, and we won’t pretend otherwise.