THE LEDGER
A coding agent finishes and tells you what it did. That summary is the least reliable artifact in the whole run — it is written by the thing being evaluated, from the same context that produced the work, and it describes intent rather than outcome. Multiply it by a fleet and you have a codebase whose history is a pile of self-assessments nobody audited.
So the claim gets written down before the work, and graded against something that can fail.
THREE MOVES
Every load-bearing intent is declared first: what is being committed to, under what conditions, and the test that would show it failed. Written afterwards it is a description; written before, it is a claim that can be wrong. The order is the whole mechanism.
The binding carries its own test, so satisfaction is decided by running it, not by the agent saying so. A grade nothing verified is a rumour with a timestamp. Misses are recorded as misses — a record that only holds successes is a brochure.
Every transition is append-only and paper-trailed. You can ask what a file was promised to do a quarter ago, which commitments contradicted each other, and where the work is drifting from what was declared. That history is the part that cannot be reconstructed later.
THE READER
Declared intents, who declared them, and which are still open.
Graded satisfied against graded violated, with the test that decided it. Not a completion percentage.
Two commitments that cannot both be true, surfaced when they are declared rather than when they collide in production. The ledger cannot answer this yet — there is no clash state and nothing reads two open commitments against each other. Today the same situation is caught by a human, who retracts one side and must state the reason.
Blame that answers the intent behind a change, not only the hand that made it — which is the question you actually have when a line looks wrong.
STATUS
This is the part most product pages leave out, and it is the only part that would make you trust the rest.
The binding substrate, its state machine and the immutable trail run inside our own house today, against our own work — thousands of bindings, graded. The record you would get is the record we already keep on ourselves.
It lives inside the apparatus and is moving out into a tenanted service, so one company's record is isolated from another's. That extraction is in progress; it is the gate between the guard shipping and this doing so.
Automatic capture of intent from an agent's own run. Today a binding is declared deliberately. Making every commit carry an intent without anyone typing it is the largest remaining piece, and we would rather name it than imply it.
WHERE TO START
The Guard is the door: it installs in an afternoon, provisions nobody, and starts producing an audit trail the same day. The ledger is what that trail becomes once there is enough of it to ask questions of — the depth behind the door, not a second thing to buy first.
One is a gate on every commit. The other is the memory of why the commits were made. They are the same record read at two depths.