The proof
Evidence
Draft. States as recorded in the repository on 2026-10-13. Nobody re-ran the checks for this draft.
This page is the proof. It lists every claim this site makes, says whether it is measured, built or not built, and names the check or the issue behind it. We show the weak spots too. Overstating a claim would cost more than showing a gap. The pages about your five questions lean on this page.
How to read the states
- Measured a check in the repository measures it, and the check is named. "Measured" means the repository says the check measured it.
- Built the thing exists, but no check measures it.
- Planned, not built it does not exist yet. The issue that tracks it is named, or it is marked as a proposal that nobody has decided on. This site calls these "planned" and never says the product does them.
Every check named is a file in the project's engine/checks/ or engine/tests/ folder. Today there is
no guide for re-running a check yourself. The five measures further down are reports, not checks: none has a pass
condition.
The ledger
73 claims. Each row can be linked to by its number, and says which requirement it serves in words, with its code in brackets. A test set is what the repository calls a golden set.
| No. | Claim | State | What it serves | Check or issue |
|---|---|---|---|---|
| 1 | Projects run side by side and cannot see each other's state or data. | Measured | Proven separation (F1) | isolation_checks |
| 2 | Every model call goes through one door. A role's model is a setting. | Measured | One gateway (F2) | gateway_checks |
| 3 | Not tied to one model vendor. Three providers answer, two are wired to the gateway, and every decided role runs on one. | Built | Independent of any vendor (vision) | Three providers answer, two wired, one used |
| 4 | Bulk work goes through batch. Anthropic's pricing page says batch saves 50 percent (tool summary, 2026-10-13). Nothing here measures the saving on our jobs. | Measured (job); price unverified | Batch job type (F3) | #148 |
| 5 | A spending limit is enforced before a call. | Measured | Cost caps before a call (N3) | ledger_checks; test_budget |
| 6 | One switch stops all spending, per project or all. It does not stop a job already running. | Measured (spending only) | Kill switch (S13) | stop_checks (4 of 4) |
| 7 | Limits on steps, tokens and wall time per job. | Not built | Runaway limits, kill switch (S13) | #58 |
| 8 | Every model call is recorded: project, role, model, tokens, cost. | Measured | Every call traced (F6) | trace_checks |
| 9 | You can read who said what to whom in the team. | Measured | Full team tracing (F18) | team_trace_checks (6 of 6); #84, #159 |
| 10 | A separate reviewer checks work before you see it. Nobody has shown that a reviewer catches a real fault. | Measured (pair runs) | Independent review (F13) | reviewed_checks; #28 |
| 11 | The reviewer cannot change the work. | Measured | Reviewer without write access (F13, S2) | reviewer_write_checks (5 of 5) |
| 12 | The reviewer is a different model family from the worker. | Not built | Different family by default (F13) | #82 |
| 13 | Nothing is published or merged without a person. No self-approval. The recorded deviation: whoever holds a project's key (Temporal token) to the engine's workflow service can send a decision under any name. | Measured, with a recorded deviation | Human approval (F9, S9) | inbox_checks; #32 |
| 14 | One inbox for everything that needs a person. | Built (per project) | One review inbox (F8) | across projects #111, #31 |
| 15 | Named reviewers per project and kind of work. | Not built | Named reviewers (F8) | #111 |
| 16 | Review items show figures, quotations and preserved sources. | Not built | Evidence on research items (F8) | #40 |
| 17 | New work is triaged before anything starts. | Measured | Mailboxes, triage first (F4) | mailbox_checks (40); 1 real item |
| 18 | A flood of items cannot flood the person. | Measured (stand-in only) | Cap on what may wait (F4, S13) | checks 7a, 8a |
| 19 | Text from outside the team is data, never orders. | Measured | Outside text is data (S8, S14) | injection_checks (9 attacks) |
| 20 | A test set must pass before a model or instruction change is used. The gate is a person's command. | Measured; gate manual | Test-set gate (F5) | golden_checks; #115 |
| 21 | The engine tests its own defences on a schedule. | Measured | Self-check (F5, S17) | selfcheck_checks (4 of 4); schedule #123 |
| 22 | Agents hold only needed tools. A worker has no write key. | Measured (in part) | Least agency (S2, N4) | reader_write_checks |
| 23 | Agents reach only the network a role is allowed. | Measured | Network denied by default (S7) | egress_checks +3; #245, #174 |
| 24 | Each project has its own credentials. Measured for workflow tokens; one provider key is shared. | Measured (tokens) | Least-privilege identities (S3) | temporal_auth_checks; one provider key shared (#170, #171) |
| 25 | Secrets stay out of prompts, traces and logs. | Not built (not met) | Secrets (S5) | #51, #84, #57 |
| 26 | Code agents run in sandboxes apart from the host. | Not built | Sandboxing (S6) | #176 |
| 27 | A full, tamper-evident audit log. | Not built | Audit log (S11), tamper-evident log (C17) | #56 |
| 28 | A data policy says which provider may see a project's data. | Not built | Data policy per project (S12), providers and transfers (C4) | #57 |
| 29 | A page shows running or stopped, all jobs, waiting items, cost. | Built | Web interface (F17) | test_page; test_jobs_page |
| 30 | Start and stop work from the page. | Not built | Web interface starts and stops (F17) | #113 |
| 31 | Set up a project from a form that opens a merge request. | Built | Project setup from a page (#239) | test_project_form (stand-in) |
| 32 | Three ways in: command line, assistant protocol, web page. | Built | Three front doors (F7) | test_mcp_server; no login #133 |
| 33 | Assistants cannot answer a gate. | Built | Gates closed to assistants (F9, S9) | test_tools (5 tools withheld) |
| 34 | A coordinator plans a job. The machinery runs one step at a time. | Measured | Coordinator (#156) | coordinator_checks; #61 |
| 35 | The aim: more work is done in parallel than by one agent at a time. No run has measured it. | Built; nothing measures it | Headline vision | none |
| 36 | Recurring work starts itself. A failure reaches the inbox. | Measured | Scheduled jobs (F14) | schedule_checks |
| 37 | A restart loses no work. | Measured (batch); laptop sleep unverified | No lost work (N2) | isolation_checks |
| 38 | The engine improves itself: evaluation, and model swaps proposed. | Not built | Improvement loop (F10) | #35 to #39 |
| 39 | A project adds checks and approvers that only raise the bar. | Not built | Project file, command runner (F20) | #198, #199 |
| 40 | Research-to-publish with sources and a publication gate. | Not built | A later project type | #40 |
| 41 | The list of agent roles is generated from what exists. | Measured | Generated register (F16) | test_permissions; CI job |
| 42 | Software, infrastructure and dependency agents. | Not built (unverified) | Software agents (F11), dependency upkeep (F15) | #10, #44, #46 |
| 43 | Pinned versions and a software bill of materials, for B Team's own software. | Measured (lockfile, bill) | Supply chain (S10, N5), bill of materials (C11) | test_sbom; #116 |
| 44 | Runs on a laptop or a small server. | Built (MacBook); server not | Host profiles (N1) | #44 |
| 45 | A planner proposes safe parallel work. You can change it. A register stops clashes. | Not built | Planner and register (F21) | #286 |
| 46 | Five standard reviewers, one per kind of review: security, documentation, compliance, Done when, architecture. | Not built | Review follows the risk (F22), compliance reviewer (C10) | #107; #299 |
| 47 | Your team chooses a human review level, shown on every change. Level A, with the line "no human engineer has read this code", is decided. | Not built | Review follows the risk (F22) | Level A decided 2026-10-13. #299 |
| 48 | A goal becomes an issue with a Done when, drafted by the engine and approved by you. | Not built | Goal to Done when (F23) | #287 |
| 49 | Test users answer a link and a few questions without any account. | Not built | Feedback and user tests (F24) | #288 |
| 50 | The code host is the single record, behind one layer. Self-managed GitLab first. | Not built | Code host as record (F25) | #279; #289 |
| 51 | Each task runs in real time or in a cheaper batch. | Not built | Real time or batch per task (F26) | #196, #65 |
| 52 | Five measures are recorded by the machinery and shown together. | Not built | The five measures (F27) | #290 |
| 53 | A guided setup into your own account or server. | Not built | Guided setup (F28) | #291 |
| 54 | You may pick only models your data policy allows that passed the test set. | Not built | Model choice bounded (S21) | #294 |
| 55 | A hosted service in Europe separates each organisation. Intended only. | Not built | Separation per organisation (S22) | #295 |
| 56 | Nothing requires a person to answer in real time. Waits have a stated turn. | Not built | Work paced to people (N8) | #65, #196 |
| 57 | Each security requirement's state is shown in your workspace. | Not built | The organisation's product owner's workspace (F17) | #113, #154 |
| 58 | Standard agents, instructions and checks come ready-made. A team adjusts them. | Not built | First project type (no number yet) | #318 |
| 59 | Models run in Europe in steps: reviewers on Scaleway, then all models, then hosting. The Scaleway key answered 200 and listed 16 open models on 2026-10-04. It is not connected to the engine, and it is replaced (#81) before it is. | Not built | Model choice bounded (S21), hosted later (S22) | Decided 2026-10-13. Not built. #294 |
| 60 | A role moves to an open model only after a test-set run against a top commercial model. The nearest built part is the test-set gate (claim 20). | Not built | Test sets (F5), open against commercial | Decided 2026-10-13. Not built. #314 |
| 61 | A shareable view for a board or funder: what was asked, built, accepted and what it cost. | Not built | Read-only view for a board or funder (F17, amended) | New requirement agreed 2026-10-13. #293 |
| 62 | Each change has a record: diff, test result, findings, risk note with rollback, approver, time. | Not built | Change record (C16) | #307 |
| 63 | Each change records which model, provider and version wrote or reviewed it, and the agent role. | Not built | Model provenance (C7) | #302 |
| 64 | You can export an evidence pack for a period, in open formats. | Not built | Evidence pack (C18) | #307 |
| 65 | A package for your buyer or auditor, from live data: suppliers, data flows, exit plan. | Not built | Supplier package (C21) | #309 |
| 66 | A processing agreement before B Team sees personal data. No own use. Its access off by default. | Not built | Processing agreement (C1), no own use (C2), access off by default (C3) | #297, #300 |
| 67 | Independent assurance for B Team in stages, with dates. B Team holds no certificate today. | Not built | Independent assurance in stages (C29) | Waits for a decision by the founder (Codrin). #306 |
| 68 | Standard agents build no donor-profiling features without a named person and an impact assessment. | Not built | No donor profiling by default (C6) | #298 |
| 69 | Each standard agent ships a test set. The system, not a person, enforces the gate. | Not built | Test sets (F5) | #115; #316 |
| 70 | Code checks what code can. AI-written checks run without AI. Each fault becomes a test. | Not built | Checks by code (F29) | #296 |
| 71 | You can read each agent's test results and traces in plain words. | Not built | The organisation's product owner's workspace (F17) | #113, #154 |
| 72 | B Team's own screens meet WCAG 2.1 level AA, with a statement. Pages the agents build get a check. | Not built | Accessibility of our screens (C26), of what agents build (C27) | #311 |
| 73 | Short training material on what the agents can and cannot do, for your staff. | Not built | AI literacy material (C9) | #302 |
The five measures
The proof will be five numbers, recorded by the machinery and shown together. One alone misleads. Effective comes first, efficient second. They answer the first question: did we build what matters? Planned, not built They are not recorded yet, so each one reads not yet measured and shows no number.
| Measure | What it tells you | Counting rule that resists gaming | Today |
|---|---|---|---|
| Accepted at first review | Was it the right thing, built right? | Counted per issue, not per merge request. | Not yet measured |
| Used after release | Did anyone need it? | You define "used" for your project before release. | Not yet measured |
| Time from decided to accepted | How fast, for each mode. | Decided means the Done when was approved. Real time and batch are timed apart. | Not yet measured |
| Human minutes per accepted change | How much of your time it takes. | From the machine's timestamps, per project, never per person. | Not yet measured |
| Cost per accepted change | What it cost. | All model cost of the issue, rejected work included. | Not yet measured |
Why the rules exist: splitting work into tiny safe pieces would inflate "accepted at first review"; "used" and "decided" are undefined until someone defines them; timing a person is surveillance; leaving out rejected work flatters cost.
What it does not do yet
Each limit has the issue that tracks it. The same list is on what is not built yet.
| Limit | Tracked as |
|---|---|
| The reviewer is the same model family as the worker. | #82 |
| Temperature cannot be set. The test sets test the duty not to invent. | #25 |
| There is no fallback model. Failover did not fire on a provider 404. | No issue found yet |
| The test-set gate is a person's command. The continuous-integration system holds no provider key. | #115 |
| The prompt-injection suite measures. It does not certify. | No issue found yet |
| Nobody has shown that a reviewer catches a real fault. | #28 |
| Early build: only two projects are registered, both on this repository. | No issue |
| Keys sit in plain files. Traces hold full words. | #51, #84, #57 |
| One provider key and one bill across projects. | #170, #171 |
| No data policy is checked against any provider's terms. | #57 |
| No audit log. No secret scanning in the build pipeline. | #56, #116 |
| No sandbox for code that agents run. | #176 |
| The stop switch halts spending, not a job that is running. | No issue found yet |
| Approval is as strong as the reviewer's GitLab login. | No issue found yet |
| There is no single queue across projects. | #111, #31 |
| The web page cannot start or stop anything, and has no sign-in. | #113 |
| It runs with Docker Compose on a laptop. The server deployment is not built. | #44 |
| The planner, the register, standard reviewers, feedback and measures are proposals. | #286, #287, #288, #290, #299 |
| No compliance reviewer yet. Its first rules would be the GDPR and the AI Act. | #107 |
| No record of each change, no model link on it, no evidence pack (change record, model provenance, evidence pack). | #302, #307 (claims 62 to 64) |
| No supplier package for your buyer, and no incident notice (supplier package). | #309 (claim 65) |
| No processing agreement template. B Team's access to client data is not yet off by default (processing agreement). | #297, #300 (claim 66) |
| B Team holds no certificate. Independent assurance has no plan with dates (independent assurance in stages). | #306 (claim 67) |
| B Team's own screens are not tested for accessibility (accessibility of our screens). | #311 (claim 72) |
| No standard agent ships its own test set, and the gate is not enforced by the system. | #115; #316 (claim 69) |
| No published contact for when something breaks, no vulnerability policy, no reporting desk. | #303 |
| A preview of a change before you accept it is planned. It needs the sandbox first. | #176; #292 |
| The hosted service in Europe is intended. Its preconditions are not met. | #295 |
| The Scaleway key answers but is not connected to the engine, and it is replaced first. | #81; #294 |
| Open models are not yet measured against a top commercial model. | #314 |
| The board or funder view is planned. | #293 |
| The licence is not checked by a lawyer. Who owns what the agents write is unsettled. | #22 |
| The name B Team is not checked as free to use. | #317 |
Checks that run by themselves
The engine tests its own defences on a schedule. Measured The list of agent roles is generated from what exists, so it cannot go stale. Measured Every model call is recorded with its project, role, model, tokens and cost. Measured You can read who said what to whom in the team. Measured Test sets must pass before a model or an instruction changes, though the gate is a person's command today. Measured; gate manual Versions are pinned and a software bill of materials is kept. Measured (lockfile, bill)
21, 41, 8, 9, 20 and 43 in the ledger above.
Planned: this page would be generated from the repository's checks, and a check would fail the build if the page were out of date. Planned, not built