Concept note · the lab vocabulary
Counterfeit code
Code that is not what it claims to be — it runs, reads clean, and does no real work.
What it is
Counterfeit code: code that is not what it claims to be. It compiles. It passes review. It reads clean. Its inputs never reach its outputs. It arrives in three recognizable shapes: dead code paths — branches and fallbacks that can never execute; severed data flow — values computed, then never used; and hollow functions — logic that looks right and does nothing. None of the three looks wrong, which is the entire reason each survives review.
In the lab
- The Deterministic Stack →
- The counter-instrument: 97+ deterministic rules over the four invariants at file-save speed, one vetted before/after repair per finding, and every verdict written to a state mirror so the audit trail outlives the fix.
Our position
The word is chosen for its standard of proof: a counterfeit is judged against something objective, and so is this. Every legitimate implementation satisfies four invariants — inputs influence outputs, computation is captured, iteration accumulates, functions produce. Violating any one is proof of counterfeit, not an opinion about style: the violation is a property of the data-flow graph, demonstrable on the syntax tree, and the verdict is the same on every run. That is also why the checker cannot be another model. A probabilistic failure cannot be caught by a probabilistic checker — a model that hallucinates code can hallucinate a passing verdict, which is precisely the defect it was installed to catch. The gate has to be math: deterministic checks, binary verdicts, an audit trail that outlives the fix.
Honest limitations
A name this sharp invites overreach, so the boundary stays explicit. The invariants catch code that does no real work; they do not catch code that does the wrong real work — a clean verdict bounds review, it does not replace it. The definition is structural, not forensic: it says nothing about who or what wrote the code, and human-written code goes counterfeit too — machine generation just raises the rate faster than human review scales. And the published measurements that make the problem legible are point-in-time analyses of open-source work, not constants; the rates will move as the tools do. The definition is what holds still.
In the record
- Entrepreneur — software quality as a founder problem (Mudit Singh) →
- The symptoms, measured: AI-co-authored code carrying roughly 1.7× more issues, with security vulnerabilities at up to 2.74× the human rate (a December 2025 analysis of 470 open-source pull requests), and 25% of Y Combinator’s Winter 2025 startups shipping codebases roughly 95% AI-generated.
Related in the vocabulary
- Code provenance →
- Meets it in The Deterministic Stack — whether code is what it claims to be — and proving it with an audit trail.
- Instrumentation →
- Meets it in The Deterministic Stack — building the instrument that makes a hidden state legible.
- Intent locking →
- Meets it in The Deterministic Stack — fixing what a request means before anything is built, so nothing downstream can read it another way.
The experiments are the proof
Every claim in this note is made concrete somewhere in the lab — the idea exists because the machines needed it.
The map of the lab →