What is, and is not, built.

Larch Helpdesk pack: reads, changes and data leaving, across two organisations

On its twin only, for black-box agents: what the agent read (the twin's access log), changed (its tables) and sent (planted markers in email and the reply). Qualified, and again at the 0.6.0 tree: 144 cells each time, no false pass or false fail. Evidence: reports/helpdesk-pack-2026-10, reports/helpdesk-requal-0.6.0.

Stripe refunds pack

Qualified before 0.4.0 and again for 0.5.0 and 0.6.0: 168 + 168 cells each time, no false pass or false fail. Evidence: reports/stripe-pack-2026-10, reports/stripe-requal-0.5.0, reports/stripe-requal-0.6.0.

Checks on the agent's tool calls (a tool never called, arguments within scope)

Being built next.

Permission tests on your own system

Not built yet.

One command starts a runner and opens an interface

From the public registry, in a clean HOME and cache. A headless box gets the URL printed.

Connect an MCP server on this machine, or over HTTP

Against servers nobody here wrote, unmodified, including one behind OAuth with PKCE.

Connect an HTTP API from an OpenAPI 3 document

JSON natively, YAML when the optional dependency is present. No discovered write endpoint is called during setup.

Connect a web application through a browser

Works, and a browser cannot verify itself. Without a readable system attached every verdict says OBSERVATIONAL, and the type refuses to let a browser be its own verifier. That is the honest ceiling, not a gap to close.

Teach one job by doing it, and survive a reload

Demonstrated in a browser, reloaded mid-recording, resumed.

Counterfactual cases synthesised from confirmed rules

How many of the ten categories appear depends on what the job touched.

Gate a build on it

Exit 0 passed, 1 the agent failed, 2 the setup is wrong. Until 0.2.0 the documented example gated on the reference implementation, which is handed the answer — a documented gate that could not fail. It now refuses.

Say how strongly a run was verified

AUTHORITATIVE / PARTIAL / OBSERVATIONAL, computed from what the connected system can actually read back, shown beside the verdict rather than in a log.

Say whether cases were isolated

It used to report RESET whenever any reset was configured, though nothing had run it twice and compared. It now says DECLARED where the reset is a tool the operator nominated.

A verdict against a real system is AUTHORITATIVE

It is PARTIAL. RigorRun reads back what the nominated reads return and no more. Claiming otherwise would be the single most damaging thing this product could do.

The full evidence hierarchy

Five tiers exist and the tier is shown beside every check, but only STATE and EVENT are ever emitted. Nothing produces a model-judged or human-review evaluator, so three of the five are unreachable today.

Refuse to write against production

A project marked production cannot be quality-checked and cannot mutate at all.

Signed verification records

Records are hashed, not signed. No HMAC, Ed25519 or sigstore attestation exists yet.

Work survives a restart, and damage is reported

The runner is killed with SIGKILL mid-flow and restarted; a deliberately corrupted project comes back naming the file rather than vanishing.

Credentials in the OS keychain

Keychain, libsecret or DPAPI, chosen by a round trip rather than by platform name. No command prints a secret.

The agent SDKs on npm

All workspace packages are private, so npm i @rigorrun/agent-sdk does not resolve. The documentation says so. Connecting an agent over HTTP needs no SDK.

Continuous drift detection, hosted scheduling, a paid tier

Deliberately blocked behind evidence that somebody wants it, rather than built on the assumption.