What the check printed

Version 1.1.3, checked on 2026-10-29 by the machine that built the download. 11 claims, and every one of them proven.

The app's own documents make a handful of safety claims: that a rehearsal changes nothing, that a spending ceiling holds, that the record cannot be quietly edited, and so on. Each claim is paired with the tests that would fail if it stopped being true. One command, npm run prove, runs those tests and marks each claim PROVEN or UNPROVEN. It needs no account, no key and no internet. Below is what it printed for this release, one row per claim, with the tests behind it and the document where the claim is made. Those documents and tests are part of the source, which we send on request.

• PROVEN

  If the sandbox cannot start, the command does not run.

  19 tests: lib/exec-target.test.ts. Claimed in SECURITY-OVERVIEW.md, How agents are contained.

• PROVEN

  An agent's shell reaches only the websites its team is allowed.

  30 tests: lib/agent-tools.test.ts. Claimed in SECURITY-OVERVIEW.md, What an agent can reach, rung by rung.

• PROVEN

  A spend ceiling is checked while work runs, counts money not yet billed, and holds across parallel agents.

  35 tests: lib/limits.test.ts, lib/run-budget.test.ts. Claimed in SECURITY-OVERVIEW.md, Money.

• PROVEN

  Anything written outside this app reaches a model fenced and labelled, never as an instruction.

  51 tests: lib/web.test.ts, lib/triggers.test.ts. Claimed in SECURITY-OVERVIEW.md, How agents are contained.

• PROVEN

  The activity record is hash-chained: an entry cannot be changed or removed without the record saying so.

  21 tests: lib/audit.test.ts. Claimed in SECURITY-OVERVIEW.md, The record.

• PROVEN

  A rehearsal changes nothing — no file written, no command run, nothing sent.

  57 tests: lib/procedure-run.test.ts, lib/plan-mode.test.ts, lib/email-rehearsal.test.ts. Claimed in PROCEDURES.md, Rehearsal.

• PROVEN

  A team with nobody accountable for it runs nothing unattended.

  26 tests: lib/team-gate.test.ts, lib/schedules.test.ts. Claimed in SECURITY-OVERVIEW.md, Who may do what.

• PROVEN

  Every email an agent sends says it was sent by an agent.

  48 tests: lib/messaging.test.ts, lib/smtp.test.ts, lib/email-policy.test.ts. Claimed in SECURITY-OVERVIEW.md, The one regulation this already satisfies.

• PROVEN

  What a connector returns is fenced before the model reads it — a record in your CRM is data, not an instruction.

  14 tests: lib/connector-fence.test.ts. Claimed in SECURITY-OVERVIEW.md, How agents are contained.

• PROVEN

  A connected app may only run the tools a person ticked, and a tool it did not have when they ticked is refused.

  37 tests: lib/connector-permissions.test.ts, lib/connector-tools-ui.test.ts. Claimed in SECURITY-OVERVIEW.md, What an agent can reach, rung by rung.

• PROVEN

  What the permissions page says an agent may do is what the app asks before it lets the agent do it.

  22 tests: lib/capability-matrix.test.ts, lib/capability-matrix-ui.test.ts. Claimed in SECURITY-OVERVIEW.md, Every agent, and what it may do.

The tests are checked too. Each control is broken on purpose, one at a time, and the tests have to notice. At its last full run, on 2026-10-27, 5655 of 5657 planted bugs were caught. The 2 that were not are holes in the tests, counted here rather than left out.

The same output as plain text, exactly as the command printed it: proof.txt.