The homepage is the short version. This page is the machine: how runhmd reaches PROVEN or DENIED, what each gate guards, and the parts built around that check. Everything here is a shipping binary unless it is fenced as coming.
runhmd sits on top of your agent. It does not write the code, and it never takes the agent's word that the code is done.
That is a claim, not evidence. Claude Code is the agent runhmd works with today; Codex, Cursor and any plain git diff are coming.
An external check the implementation cannot satisfy by asserting success: a mutation oracle that passes only when every injected mutant is caught, a corpus of real past failures replayed on every change, a secret scan, lint and tests.
DENIED: a gate went red, the push is blocked and the failing evidence is shown so the agent can fix it. PROVEN: every gate passed, and each one has been shown able to fail. Either way, the merge is yours.
runhmd puts verification gates in front of AI coding agents: every change ships behind an external, falsifiable oracle that must be proven able to go red before it's trusted green. A gate that can't fail proves nothing.
Every fix wires a check the implementation can't satisfy by claiming success. It's written so it can actually fail — no test that cannot go red.
The PR ships only on a gate-PASS: deterministic checks that go red on failure, not the model's say-so. The verdict rides along as evidence.
The gates decide with falsifiable checks; the model does the reasoning and generation. Prove with tools, reason with the model.
The maintainer opened its first autonomous PR end-to-end on real Cloud Run + Firestore — a gate-PASS fix a human merges. Behind it: the isolation oracle, the reuse engine measured on 8 cold repos against a frozen rubric, and the open bring-up ladder — 29 real bugs, found and fixed before that PR.
bin/corpus replays every real failure the gates have ever caught, on every change. A regression that once got through becomes a standing test. The corpus status and its dip log are published, dips included.
A verdict you cannot inspect is just another claim. What exists today: an evidence block on every bot PR and a machine-readable report. Hosted, shareable receipt pages are on the roadmap.
A machine-readable evidence block (the SI-2 attestation) rides with the PR: which gates ran and what they returned. The reviewer sees the proof next to the diff.
hmd reportA machine-readable report of every gate, mutation score and corpus catch-rate from the last run.
The flagship eval status keeps its failing rows visible, and the corpus keeps its dip log. A verification system that cannot show you its own failures cannot be trusted with yours.
Every fix — the bot's or your own — runs the same gates before it can ship. Each item below is a shipping binary, grouped by what it guards.
--no-verify →Visual-parity gate for React Native screens — your build scored against the design canonical. /hmd:designmatch
Each dev's triage — the deny and verdict cases the oracle gates produce — is captured into a shared corpus the whole team learns from together, instead of staying stuck in one person's head.
Reuses existing code instead of reinventing it — the part measured to generalize on cold repos.
Runs measured keep/discard experiments on its own routing — the parts that don't help get cut.
hmd --team NSpawn N parallel Claude workers on one task, locally.
The watchman HUD self-bootstraps for every teammate on SessionStart — no manual config — and renders across any terminal (Warp, iTerm2, Terminal.app, tmux, screen, VS Code, kitty, Alacritty) via capability tiers (truecolor → 256 → plain).
Not a diff dumped over the wall — a reviewable PR with runnable evidence and an honest attestation. The autonomy ends at the merge button.
Every request is Ed25519-signed and the team_id is derived server-side — a client cannot claim another team. Each team's Claude cred lives in its own Secret Manager partition, under a per-team daily spend cap. The public surface is enqueue-only and provably cannot dispatch. We wrote a cross-tenant attack oracle — every mutant a real breach attempt — and it kills every one (the live score is on the proof page).
Prereqs, once: install hmd, install the GitHub App on your repo, and run claude setup-token for your own Claude credential. Then:
rr at the control planerr setup --mode control-plane --endpoint <endpoint> --enroll-token <enroll-token>Writes your mode + endpoint. The enroll token is a one-time bootstrap credential your admin hands out — never your signing key.
heimdall-presence beatGenerates a local Ed25519 keypair and enrolls it. From here on, every request you send is signed — the server derives your team_id from the signature, so you never send it.
rr connect --gh-app-installation-id <id> --repo <owner/repo>Two signed POSTs: your Claude credential (write-only, into your team's own Secret Manager partition) and your GitHub App installation. The bot works with your tokens, on your repo.
The maintainer clones, fixes with your Claude sub, and opens a PR on a heimdall/* branch. It cannot push to main and it cannot merge — that's yours.
rr drives the cloud maintainer; hmd runs the gates and swarm on your own machine.
A presence wall for your team: who's online, what each watchman is verifying, the file they're on, and how fresh the last beat is. Scoped to the teams you belong to — nothing else. Teammates auto-join by GitHub repo access — the first dev on a repo initiates the team, everyone else joins with no invite and no pasted secret.
The page shows a one-time device code — run hmd dashboard login <code> in a terminal where hmd is signed in, and your local HAID key proves who you are. No password, no pasted secret: the browser only ever holds a short-lived, server-scoped session token — never a team secret.
One product, one command, one engine name. Everything else is a subsystem, described here by what it does.
Command names in your terminal are what they are today: hmd, rr and the /hmd:* slash commands. Consolidating them under hmd is planned; this page follows the commands, not the other way round.
There is no benchmark number on this site yet. When there is, it will answer one question: how often does an AI agent say “done” when it is not, and how often does runhmd catch it?
The share of tasks an agent marks done that fail an independent, human-written ground-truth check.
Of those false greens, the share runhmd turns into DENIED, with each denial confirmed by a human as a real defect or a false alarm.
The task list registered before any agent runs, every raw result — including where runhmd missed or was noisy — model versions and settings, and a script to reproduce it. If the catch rate is weak, that is the finding.
None of the below ships in the current build. It's fenced off on purpose, so what you install is only ever what's proven. Recently landed: the first autonomous PR proven end-to-end, multi-tenant rr on a live control plane, per-team BYOC with daily spend caps, the cross-tenant isolation oracle, presence opt-out (per-repo + global invisibility), and the self-bootstrapping statusline — now shipped, no longer roadmap.
npx runhmd attack <your-repo>: try it on a repo with nothing installed and nothing written to your machine. Today: the verified install on the homepage.
One comment per PR, updated in place: PROVEN or DENIED, with the counterexample and a link to the receipt.
A shareable page for every verdict: gates passed and failed, whether each gate was shown able to fail, counterexamples with minimal reproductions, agent and model, cost and duration.
Codex and Cursor adapters, and a fallback that verifies anything that produces a git diff or a PR. Today: Claude Code.
Remote controls (the app side is built; it needs hmd's side), diff and transcript views, and attaching a screenshot. Today: status, chat, questions, deny, push.
A front door that vends a bounded enroll token, so a team can onboard without an admin handing one over. Today: admin-issued tokens.
rr status <task-id> reading the live queue + PR state, so you never poll blind.
Proposes and performs the cut, not just flags dead code.
Multiple humans on one project, with shared state and conflict awareness. Today: N parallel workers + coordination ledger.