Applied AI · Code Provenance
Two working · one specified
The Deterministic Stack
Lock what was asked for, gate every change an AI makes, repair what is already written — with no AI doing the checking
1 · The stack
2 · The Cartouche Monitor
3 · Closer
4 · CodeRadar
What this is
Three programs that keep an AI coding agent honest, in the order a change meets them. The Cartouche Monitor fixes what a request means before a line is written, and watches the build against it. Closer fences the agent in and judges each change before it lands: counterfeit is rejected on the spot and sent back to be rewritten and re-tested, and only an accepted change reaches the file. CodeRadar watches what is on file and catches, then repairs, counterfeit code that got there anyway. None of the three asks a model whether the code is right; each check is a rule or a proof, and gives the same answer every time.
The technical shape
- Order
- Cartouche Monitor → Closer → the file is written → CodeRadar
- Cartouche
- an agreed film → a signal track → five locked sub-glyphs; drift is measured as a residual and sent to Closer as a warrant
- Closer
- three tiers: you the signer, a restricted writer (Read · Grep · Glob · mcp__gc), a gate of fixed code · bin/gc + pack/live v33
- Closer's checks
- W1 World intact · R6 read the World · G18 no caches · S1 no fake-shaped code · E1 suite passes · C1 claims hold · U1 before/after
- CodeRadar
- supervised daemons · about 190 checks in ten families · one ranker over a 257-row table · one repair per finding, with before/after mirrors
- Record
- a hash-chained, append-only ledger: every accept and reject, expected against observed
- Stance
- offline by default · no model in any check · the same verdict every run
- Stage
- CodeRadar and Closer run today · the Cartouche Monitor is a specification, its compiler and scanner drafted
The deep end · full technical outline
Outline v2 · expanding
Why three, and why no AI
Most of the market answers AI-written code with a second model — have an AI check the AI. But a probabilistic failure cannot be caught by a probabilistic checker: a model that writes counterfeit code can just as easily write a passing verdict. Every gate in the stack is an AST rule, the repo's own tests, or a sealed claim; kernel, scanner and pack import no model client and no network module. And no single gate is enough, because counterfeit enters at three moments: when the request is misread, when the change is written, and after it is on file.
What counterfeit code is, to all three
Code that performs the appearance of work and still passes tests: stubs, constant returns, swallowed exceptions, answer tables keyed on the tests' own inputs, pass-throughs that claim to transform, writes that go nowhere. The Cartouche Monitor sees it as a build that drifts from what was agreed; Closer names eleven species of it, T1 to T11; CodeRadar catalogues it per rule family.
One loop, one record
The Cartouche Monitor fixes what was asked for, so Closer judges a change against the intent and not against the agent's reading of it. Closer decides whether a change may land. CodeRadar decides whether what landed is counterfeit and hands back one repair — and a repair re-enters through the signer as a new ticket, so every write, a fix included, still passes the gate. Every verdict is written to a hash-chained ledger that cannot be edited after the fact.
The handoff between the gate and the watch
Closer sits before the write; CodeRadar sits after it. The repo is the only surface they share, and neither calls the other. The division is a ruling: Closer hunts species T1 to T10 at land, and a T11 counterfeit — right on every tested input, wrong on one the tests never give — is allowed through the gate for CodeRadar to catch in the live build.
Where it stands
CodeRadar's read-and-apply path has completed live sessions on real libraries (click, tqdm and others); its direct write route has not completed a live cycle and is marked unfinished. Closer runs live pack v33 with S1, E1, C1 and U1; its proving set is being rebuilt from fresh AI-written counterfeits on two real apps, with 34 real open-source bugs reported beside it. The Cartouche Monitor is a specification, its compiler and scanner drafted. One early blind test of CodeRadar found 2 of 6 planted counterfeits with 6 false flags — the number the calibrator exists to fix.
1 · The Cartouche Monitor
The fork in the sentence
"Kids make nutritious snacks" is two sentences sharing one set of words. App requests do the same thing quietly. "Find me pictures of dogs in costumes I can buy" — a costume to buy, or a dog to buy? "Remove my ex from my photos" — paint them out, or delete every photo they are in? Both readings are grammatical, so a builder that picks the wrong one has followed the words exactly. Better code does not help; the request has to stop forking before anything is built.
Show it before it's built
The Cartouche answers a request with a film rather than a question. The user watches the app do its work: the main actions in order, then each permutation, then the edge cases — the walker who is late, the dog that limps, the husband who already walked it. A film is hard to misread. If it is wrong the user says so and it is cut again; when it is right, they agree, and that agreement is what everything after is held to.
Words become signals
Every word and every small action in the agreed film is a signal. The film is cut from clips — one clip per word, per action — and concatenated with ffmpeg, happy path first and edge cases at the tail, so the timeline is itself the list of what the app must do. The signal track that comes off it is a list of hashes. A dictionary of signals grows with each app; most words recur, so most signals already exist.
Signals become glyphs
Each signal has a glyph, drawn after the hieroglyphs: a walker, a house for pick-up and home, a sun for the time of day, water for rain, a mouth for "tell me". An app's glyphs drawn together inside a cartouche are its template — the name ring the Egyptians drew around a king's name, here drawn around an app's intent. A missing glyph shows as a hole; a glyph out of place shows as a shift.
Hashed and locked
The agreed film, its signal track and its template are hashed together into one locked intent bundle: certified once, by a person watching, and frozen. From then on nothing reinterprets the request — no model rereads the prose and guesses again. The variables a user brings later (which dog, which walker, which times) fill the bundle; they do not reopen it.
The template watches
The cartouche is the monitor. Whatever is proposed against the bundle is projected onto its glyphs: every region filled and in order, it matches what was agreed; a region empty, it does not. "Skip the walk when it rains" drops the rain signal the user agreed to, leaves a hole in the template, and is held. The bundle stays what the user meant until the user agrees to something else.
Where it sits
The Cartouche is the first of three programs that keep an AI coding agent honest. It fixes what is meant before a line is written. Closer judges each change before it lands and sends a counterfeit straight back to the agent to rewrite. CodeRadar watches the files after they are written, and finds and repairs counterfeit code that got through. Intent, then the gate, then the watch.
What is still open
This is a specification imagined in October 2026, with its compiler and scanner drafted, not a shipped product. The dictionary has to be built, and a library of clips large enough that most apps can be filmed from it. Choosing the permutations and edge cases worth filming is a judgement, and a film that misses one leaves that fork open. And live use will go off script — "whaddya need?" instead of the line that was certified — so it must snap to the nearest agreed signal, not invent one.
2 · Closer
Three actors
The signer is a person with the shell and the keys. The writer is a Claude Code session with almost nothing: Read, Grep, Glob and one MCP server — no shell, no editor, no other servers. The gate is the fixed code between them. Everything the gate learns is filed where the writer cannot read it.
Narrow the seat, not the prompt
The writer's limits are enforced, not requested. A PreToolUse hook repeats the allowlist as a second wall; a Stop hook refuses "done" until the gate's own check exits 0. The writer can only stage files inside the ticket's write set and call land. Nothing it does touches the repo until the gate says so.
The World and the claims
gc init and gc scan freeze a write-once snapshot of the repo — the World — verified by file list before anything touches it. The signer states what the change must do as claims: small sealed tests, each a dotted name the task requires, optional setup, one call and one expectation. Claims are drafted from the task's acceptance criteria by fixed tables, never by an agent; the signer fills every placeholder. No claims, no ticket. The writer never sees them.
The ticket
Minting binds the World, the claims and the write set into one ticket by their hashes. It reaches the gate down a channel the writer cannot read, so the agent cannot tune its code to the test it will face. One task, one ticket; the agent can only write through it.
Land: every check, on a copy
At land, fixed code applies the patch to a sandbox copy and runs every check: W1 the World intact, R6 the World read, G18 no smuggled caches, S1 no fake-shaped code, E1 the repo's whole suite, C1 every claim under a clock and a line budget, U1 the pre-existing functions unchanged on the same inputs. Any non-zero exit flips the governor to reject; the saved copy is restored.
S1, the shape of the lie
S1 is pure AST, scoped to the functions the ticket introduces. Its nine live rules: stub_body, const_return, swallow, hollow_test, theatre_return, factory_none, finally_return, always_true, identity_return. A claim that fails names the function and the gap: pass_through, fake_check, answer_table, fake_effect, partial, or cannot_judge.
Reject, rewrite, re-test
A rejected change is rolled back, the ticket struck, and the counterfeit goes straight back to the agent to rewrite under a new ticket, judged again in full. Retries are bounded: after N struck tickets on a task, set by the signer, no more are minted. An accepted change appends a hash-chained ledger row recording the kernel, pack and claims hashes it was judged by.
Checks must prove themselves
Ruling T1: a check that does not catch is trash. Every live check carries planted counterfeits that must fail and honest twins that must pass before it goes live, and a change to the pack needs the signer's yes. The current pack, v33, carries S1, E1, C1 and U1 among its checks.
3 · CodeRadar
What counterfeit code is
Code that parses, passes linting and type checking, and reads as logically sound to a reviewer — while violating mathematical invariants every real implementation must satisfy. Not broken code: broken code throws. Counterfeit code runs; it just does not do what it claims. Its shapes are recognizable: identity functions that compute a result and return the input; mutation theater that builds a cleaned list and returns the original; pass-only stubs behind confident docstrings; dead computation written to look busy. Every one of them passes ast.parse, mypy, and ruff.
Why it accumulates
Agent reliability degrades along two axes at once — task difficulty and codebase size — and the failure concentrates where both dials are turned up, which is exactly where developers reach for AI help. Compounding it: no human reads at agent speed. An agent produces hundreds of lines across dozens of files in minutes; reviewing every line negates the speed advantage, skipping review means trusting output at its least trustworthy. The only resolution is validation that runs at agent speed — deterministic, local, real-time.
The four invariants
Every legitimate implementation must satisfy four conditions: inputs influence outputs (every parameter reaches a return value through the data-flow graph); computation is captured (assigned variables are read, calculated values used); iteration accumulates (loops build state, not overwrite it); functions produce (a return value or a side effect). Violating any one is sufficient proof of counterfeit. Verdicts are binary — no scores, no thresholds, no confidence percentages to adjudicate.
The mathematics
Data-flow reachability: build the directed graph of variable flow, run backward DFS from all return values — any declared parameter outside the reachable set is accepted but never influences output. Dead stores by set difference: written − read. AST structural hashing proves an if and its else are the same branch (hash equality on the dumped subtrees, line numbers ignored). Algebraic-identity and tautology checks catch padding (x + 0, x · 1) and decisions that are not decisions (x == x). A cyclomatic floor flags validators with no branches; statistical bounds (μ ± 2σ against known-good code, 2× excessive / 0.5× underuse per metric) flag functions that are mathematically unlike real implementations.
The daemons
CodeRadar runs as a supervised set of daemons over one repo, after a verified snapshot and a 21-step health check of its own engine. They rescan the live code frame by frame: an AST and circuit watch (mypy, CRC fingerprints of frozen functions), a validator running about 190 checks in ten families — every one a pure predicate on the AST, true or false — and the live proof dashboard. Detection records raw observations and never scores. File save to verdict in under five seconds, sub-second for a single edit, offline, no API, no tokens, no model drift. (The film draws them as three, ω₁ ω₂ ω₃.)
One decision, fitted on honest code
A single ranker decides which functions are counterfeit. Every rule id has a row in a 257-row disposition table: deciding, or context. A deciding id fails the function; a context id is published dimmed and never decides. The table is data, fitted on fifteen honest open-source libraries with more held out; a rule family is admitted only when it holds on at least seven of them and loses none of its planted counterfeits. Unattended repair must preserve behaviour, or it is withheld with the reason shown.
One fix, not a menu
For each infraction the cheatsheet builder generates candidate repairs, ranks them against a profile learned from the repo itself (framework, naming, defensive-guard conventions), and gates them: must parse, must differ from the original, must introduce no dangerous patterns. One vetted before/after pair ships per finding. The asymmetry is by design — detection needs graph theory; the repair is almost always simple, because counterfeit code fails by omitting something straightforward. Cross-file forensics trace blame through the import graph to a natural wall — logical, permission, or cyclic — and a layered-error peeler chains compatible fixes when one repair uncovers the next.
Zeroed mirrors, live supervision
Every validation cycle writes .noai_state.json mirrors to every directory: findings, recommended order, and the before/after for each repair. In the full configuration four coordinated agents watch the mirrors, apply the fixes, run the tests, and resume building only when the mirrors read zero — provable clean state, not a feeling. Above it all, the live circuit graph makes agent damage visible in seconds: the documented save was an agent severing every import from an __init__ mid-“fix” — nodes went red, the developer interrupted at that exact moment, and days of building on a broken foundation never happened.
Related in the lab
- IMAXING Latent Space →
- Shares instrumentation — building the instrument that makes a hidden state legible.
- Replacing Resumes →
- Shares instrumentation — building the instrument that makes a hidden state legible.
Built at this bench
The machine, the instrument, the film that explains it — all designed and built in-house. The same bench works for hire.
Services →