The headline receipt: the cloud maintainer opened its own first PR, autonomously, on real Cloud Run + Firestore — and a human merges it. A check that can't go red proves nothing. So the multi-tenant isolation was attacked, not just asserted. Every bring-up bug is listed out below, none buried. And every oracle on this page is built to actually fail — the only reason a green here means anything. Engineers trust receipts, not adjectives.
Not a demo, not a mock. The cloud maintainer read an open issue, wrote the fix with Claude, proved it with the gate — the issue's own failing test went green — pushed a clean branch under the GitHub App bot identity, and opened a pull request. On real Cloud Run + Firestore. A human merges it. The bot never can.
heimdall/* and cannot self-merge. The human gate is the feature, not a limitation.
A shared control plane holds every team's credentials, so "we isolated it" has to be falsifiable. We wrote a cross-tenant attack oracle: 23 mutants, each the same isolation model with exactly one gate removed. With that gate gone, a real breach succeeds — and the oracle goes red. All 23 are caught. It shipped at six and grew to 23 as the login, god-surface and auto-join paths landed — the number below is whatever the command prints today, not whatever it printed the day this page was written.
Team A sets team_id: B in the request body to operate as team B. Killed: the server derives team_id from the Ed25519 signature — a body-set team_id is ignored.
Team A's job resolves a shared/global model cred instead of its own. Killed: every cred read is keyed by the per-team Secret Manager partition, with no cross-team enumeration path.
Team A drains team B's task queue for the same repo name. Killed: the queue partition key is (team_id, repo), not repo alone — A can never see B's rows.
Team A names team B's repo slug to open a PR there. Killed: a repo↔team authorization check (team_covers_repo) blocks a repo the team wasn't granted.
Team A wields team B's installation_id to PR on B's repo. Killed: the installation is resolved server-side from the caller's team — a wire param is not honored.
A popped public surface tries to grant a cred and dispatch. Killed: the public boundary is enqueue-only — a code-scan asserts it references no cred-read and no dispatch symbol.
Those six are the original attack surface. Seventeen more landed with the login, god-mode and auto-join paths — each one a gate removed, each one caught. The names below are the mutant ids the command prints, so you can diff this list against your own run.
Standing this up live surfaced 29 real production bugs, all found and fixed before the first PR — every one the same class: a green test on the laptop hid a deployed-shape break the container couldn't survive. We don't hide them. Each fix has a named cause, and each closed with a deployed-shape test so it can't come back. The first fourteen rungs of that climb:
/team/cred 503. Added the dep + a build-time import guard.mode=control-plane → bare rr SSH'd a VM instead of POSTing the task to the queue.HEIMDALL_CP_JOB_NAME explicitly.min-instances=1 + no-CPU-throttling./app failed; the cloud job has no checkout. Fix: resolve a writable workspace and clone the repo there..maintainer.enabled file → added explicit server-set task authorization for drain-dispatched cycles.PORT, K_* in the job override caused a live 400 → filter reserved Cloud Run names.used:0, and every failed cycle names its cause via error_tail.open_pr's return value was discarded, so a failed gh pr create silently faked PR_OPEN — every run since bug #21 had reported success while failing. Fixed with an honest PR_FAILED state: flagged, loud, re-runnable. Turning phantom greens into named errors is what let bug #29 and the real PR fall in minutes.Every AI coding tool claims it works. Heimdall measured whether its reuse engine actually generalizes — and published the number. It was pointed at 8 open-source repos it had never seen — five JavaScript, three Python — on tasks where a competent developer would reuse existing code rather than reinvent it.
The pass thresholds were frozen before the run, so the verdict couldn't be tuned to look good — a low number would have shipped as a finding. The run even surfaced and fixed its own measurement bugs before reporting — missing toolchains, missing test dependencies, a buggy assertion — rather than quietly passing. The 8 / 10 working-output figure is adjudicated, not the raw machine count: the run scored 6 / 10 unaided, and two repos were re-graded up because their failures were measurement artifacts rather than bad output. The honesty is the brand. It came back GENERALIZES.
The discipline behind every number on this page: a check that can't go red proves nothing. The isolation oracle only counts a mutant killed because dropping the gate makes the attack succeed. The self-scan runs at pre-push over the full history — so a --no-verify commit can't slip a secret past it, and during development one such commit was caught doing exactly that.
There is one door, and every push goes through it: a push is proven only when every gate passes — and the gate that proves it can't be the one that decides to skip itself.
A staged failure you watch deny, fix, and pass on the first run — the same loop Heimdall runs on every real push, and on every PR the cloud maintainer opens.
Install it, point rr at the control plane, connect your Claude sub, and let the maintainer open a proven PR. Pinned, BYO-credential, MIT.