v0.1.0 — first stable protocol

First tagged version. This marks the protocol as stable enough to build on and to disagree with — not the project as mature.

What it is

A skill for coding agents, for work where you do not intend to read the implementation. Confidence comes from two artifacts instead: an executable spec the human approves before any code exists, and an evidence report bound to a commit showing the code ran a gauntlet of constraints. Trust moves from inspection to constraints.

It is for high-stakes changes — money, auth, data loss, concurrency, public API. For a routine fix, write good tests directly; this loop costs more than it returns.

In this release

• The loop — SPEC → RED → GREEN → REFACTOR → GAUNTLET → EVIDENCE, with every test watched failing before it counts, and any test that passes immediately proven non-vacuous with a throwaway mutant.
• Ten always-on gauntlet layers — suite, types, lint/format, changed-line coverage (as a gate, not a report), mutation, property-based, complexity budget, real execution, supply chain and secrets, suite health.
• Six anti-gaming rules, absolute. The gauntlet only creates trust if it cannot be gamed, including by the agent running it.
• Three calibration tiers, so a typo does not pay for a Tier 3 failure model.
• Independent verification (Tier 3 option, marked experimental) — a fresh-context agent that attacks the finished work before EVIDENCE is signed, with a grading rule so the process terminates.
• A worked demo — demo-rate-limiter/, a real library with a real evidence report bound to a real commit, green in CI.

Known limits

Stated here rather than discovered later.

• Independent verification has one case study behind it, not a benchmark. All six rounds ran on the same model as the builder, so their convergence shows the findings are reproducible, not independent of model bias. The A/B design that was supposed to measure a false-positive rate failed — the control arm turned out not to be clean. Written up in references/verifier-case-study.md.
• The demo's evidence report carries a disclosed list of changes made after the last verified state, and its final source state is recorded as not performed rather than inheriting an earlier verdict.
• The demo's mutation layer uses a hand-rolled runner because no tool supports its Python version — which is precisely the case the skill now tells you to avoid where a real tool exists.
• Evidence is generated locally on Python 3.14 while CI gates on 3.12, and the shell scripts that implement half the gates have no lint layer of their own.

What the case study found

The demo was passing ten layers, 100% branch coverage and 8/8 mutation, with an evidence report rebound several times. A fresh-context agent still found an unbounded key map usable as a remote memory-exhaustion attack against the component meant to prevent one, a limit=NaN that made the limiter always allow, over-allow under threads — and a mutation runner reporting kills for mutants it never executed.

That last one is the reason several rules in this release exist. It could only ever inflate the score, so it could never surface as a red gauntlet. The same shape has now appeared five times in this project: a coverage layer that printed a percentage and exited 0, a gate that failed closed perfectly while guarding a spelling, an approval that was an answer to a different question, a green suite reported from a tree that could not have run it.

A mechanism that reports success while doing nothing is the failure this approach is most exposed to, because the human — by construction — is not reading the code and has no second route to find out.

Credit

The idea is Uncle Bob Martin's: don't read the code, make it run the gauntlet. The rules here are what happened when that was taken literally and then attacked.

Thanks to @drmikecrowe, whose fork has been running this daily and whose PRs closed two of the five holes above.