How it works
How it decides
A funnel that goes from cheap to careful. Most things are settled by plain rules in a blink. Only what’s worth a second opinion goes to the model, and the final word always stays in code.
#The funnel
- Inventory
Find everything aboard, in one pass, with no setup.
- Memory by content
Every item is fingerprinted. Anything whose bytes haven’t changed since last time is skipped, and anything you’ve cleared stays cleared until its code changes.
- Facts from the syntax tree
A pass over the code’s syntax tree finds what it can actually do. Each fact keeps its file and line.
- Combinations, in code
Some pairs of facts mean more than their parts. Only these can hold the ship.
- Claim against behaviour, on your laptop
For anything worth a second opinion, the local model compares the item’s own description with its short list of facts.
- Severity stays in code
The model can nudge a single fact, never a combination.
- The morning report
One verdict, a short queue, the real code, and an honest map of what couldn’t be read.
#The facts it looks for
Facts are things the code can do, read from its structure, not guessed from its words:
- making network calls
- running other programs
- writing files, especially in places that survive a restart
- reading secrets: credential files, keys in the environment
- building code at runtime, like
evalor aFunctionmade from a string - install scripts
- hidden characters, like text that reads differently to you and to the computer
None of these is bad on its own. A downloader makes network calls. That’s why most facts are only noted.
#What can hold the ship
Only combinations found in code:
- a credential file read next to a network call,
- decoding something, then running it as code, in the same function,
- writing to a place that starts programs at login,
- hidden direction-changing characters in code,
- a skill that tells your agent to keep something from you,
- an IPC handler a page can reach that never checks the sender and starts programs or opens a computed address.
#The four levels
| Level | Means | Who can set it |
|---|---|---|
| Held | Does more than it says. Look before you ship. | Only a combination found in code. |
| Worth a glance | A fact the description doesn’t call for. | The rules, or the model raising a single fact. |
| Noted | A power you’d expect from it. | The rules, or the model lowering a single fact. |
| Fine | Nothing found. | The rules. |
#What the model does, and doesn’t
The model sees the item’s own description, marked clearly as untrusted data, and the short list of facts. It says, fact by fact, whether the description calls for it, and it must cite fact ids that exist. It never sees your other code, and it never decides alone.
- It can move a single fact one step up or down, never past “worth a glance”.
- It can never lower a hold. A combination found in code stays held.
This is what makes prompt injection pointless here. A README that tells AI scanners to approve everything can sway the model, and in testing it sometimes did. But the hold comes from code, and the model can’t touch it.
The model isn’t repeatable bit for bit: between two runs on the same project it moved 4 package verdicts by one step. Rules-only verdicts didn’t change at all.