01
Scan
Any repo → graded review + proactive CI findings (breadth).
Bounded public-GitHub review available; proactive CI planned.
TRUST PIPELINE / EVIDENCE, NOT OPINION
Review any codebase.
Prove the parts that matter.
Ship a certificate that travels.
AI proposes, the checker certifies, the certificate travels — a provenance-graded, re-checkable trust layer that sits above any pipeline (SAW, Cryptol, Verus, Dafny, Lean, or plain static analysis).
We check and certify — we never generate-and-trust.
BUILT ABOVE YOUR CHECKERSSAWCryptolVerusDafnyLeanStatic analysis
HOW IT WORKS
A signal path. Not a leap of faith.
- 01
PROPOSE
AI drafts
- 02
CHECK
Named methods
- 03
CERTIFY
Record the scope
- 04
TRAVEL
Anyone re-checks
A human defines the property and assumptions. Named checks produce evidence; the certificate preserves the method, source revision and limits. Re-checking depends on the method and available artifacts.
THE PRODUCT
Five tiers.
The same certificate throughout.
From broad review to deep assurance. Expand the evidence, not the claim. Current capabilities and planned workflows are distinguished below.
02
Certify
Critical cores → AI-extracted invariants, machine-checked, sealed certificate (the moat).
Selected recorded proofs and certificate demos available; automated extraction and sealing planned.
03
Guard
A proven property → CI gate that blocks any regressing PR with the counterexample.
Planned workflow · production CI gate not connected.
04
Modernize
Legacy → new: parity-oracle + refinement proof on extractable cores.
Planned workflow · no autonomous rewrite or refinement runner.
05
Attest
Auditor/regulator-facing re-checkable attestation.
Evidence exports available; auditor attestation service planned.
EVERY CLAIM IS GRADED
Know exactly how much
a claim is worth.
Unlike AI reviewers that emit opinions, every Trust Pipeline claim records its provenance and the evidence needed for independent re-checking. An opinion never wears a proof’s clothes.
AI-suggested
A proposal to review, not an earned verdict.
tool-asserted
A named tool reports a result; its trust and scope are explicit.
machine-proved
A checker proved the stated property under the recorded model and assumptions.
refuted
The property fails, with a counterexample where the method supplies one.
Green-but-wrong is the enemy. A proof is only as strong as the model’s fidelity to the code. Record fidelity gaps, assumptions and unresolved bridges; a digest binds bytes, not their truth or sender.
LIVE DEMOS
These compute for real,
in your browser.
Working checks, not mockups. Each demonstration keeps its model, method and limits visible.
Vibe Check
Check tiny code properties with real Z3-wasm. Find the counterexample or carry a re-checkable certificate.
LIVE / SCOPED SMT CHECKS
capDL Isolation Lab
Compute reachability and policy violations in the displayed graph model.
LIVE / TYPESCRIPT GRAPH CHECK
Heterogeneous Agreement Gate
Run Z3-wasm now and compare with recorded Lean results. Lean is not replayed here.
LIVE Z3 / RECORDED LEAN
Certificate Re-checker
Recompute receipt integrity in your browser. The public demo key does not authenticate origin.
LIVE / DIGEST & DEMO SIGNATURE
Take-Grant Authority Simulator
Compute authority propagation and closure under the displayed take-grant model.
LIVE / AUTHORITY PROPAGATION
WHO IT’S FOR
For teams where correctness matters.
01
Enterprise legacy modernization
Prove the rewrite preserves behavior, slice by slice.
02
AI-native platforms
A trust layer over AI-written code.
03
High-assurance / crypto / infra
Real machine-checked proofs on critical cores.
WHAT THIS IS
- A portable, re-checkable certificate layer.
- Machine-checked proofs on extractable cores.
- Claims graded by provenance.
WHAT THIS IS NOT
- A new prover.
- A claim that AI proves whole codebases.
- “Generate and trust.”
MAKE THE EVIDENCE TRAVEL
Build with your checkers.
Ship with a clearer trust story.
Get started Start with one bounded property. Keep every assumption in view.