AI writes more code than anyone can read line by line. Flow Agents puts gates in the loop, so a change arrives with the commands that actually ran and the exit codes they returned — and stops when the agent's story and the log disagree.
The unreliable narrator
Agents rarely lie — they narrate. Long session, compacted context, and the story drifts from the log. You've probably watched all five of these:
"Said done — never actually ran it."
Long session, compacted context. The agent reports the check it remembers intending to run. Not a liar — an unreliable narrator trusting its own memory.
Caught by nothing in the log shows that command ever ran. If the project declared that check, the gate runs it itself and uses the result — not the agent's memory. If it can't, the claim is marked unverified rather than accepted.
"The summary said pass; the log said fail."
The prose wrap-up claims green; the harness-written capture recorded exit 1 while the command actually ran.
Caught by claim and capture disagree, so the turn is blocked as a caught false-completion. The narration never outranks the log.
"Masked the exit code."
npm test || true, a trailing exit 0 — the command can no longer fail.
Caught by a command that masks its own exit code can't stand as evidence: the gate flags the claimed pass as untrustworthy, and CI refuses to reconcile it.
"Edited the evidence record."
Hand-fix the stored result to say pass.
Caught by editing a record breaks its self-hash; the tamper-evident chain flags it.
"Made the gate green under pressure."
Write whatever record turns the gate green.
Caught by status is recomputed from evidence the agent doesn't author, and CI re-runs the declared checks fresh in an environment the agent never touched.
Three things this doesn't catch: a check that genuinely passed isn't re-invalidated when the code changes afterward, running one test file instead of the suite looks the same as running the suite, and an edited test slips through the runtime gate. The full list of what gets past it →
How a gate knows
A kid can say "I brushed my teeth" for free. The toothbrush either got wet or it didn't. Flow Agents treats an agent's "tests passed" the same way: the claim costs nothing, so it's never what a gate checks.
agent"Ran the full test suite — everything passes. Ready to merge."
capturenpm test → exit 1· written by the harness while the command ran, tamper-evident
recomputeclaim says pass · capture says fail
⨯ turn blocked — claim contradicts capture. The narration never outranks the log.
Staged replay of the runtime catch that ships in the hooks — the recognition moments above are the real cases, and the receipts recompute for real →
The agent says "tests passed."
The harness already wrote the log while the command ran — real exit codes, a tamper-evident record, never the model's narration.
Status is recomputed from the evidence. When the claim and the capture disagree, the turn is blocked.
A prompt asks an agent to be careful; a gate refuses to let the work pass until the evidence is there. In Claude Code and Codex, Flow Agents blocks the turn when a claimed pass and the recorded result disagree — in other runtimes it surfaces the disagreement to you instead of blocking. Either way, CI re-runs the same checks fresh, in an environment the agent never touched, before "done" counts.
You don't have to take our word for any of this — this site ships through the same gates. Every change here merges behind a required check that re-runs this repo's own verification in CI and, when an agent published its claims, fails on any disagreement with what CI actually observed.
Convinced?
Bring us the workflow you want to make inspectable — join as a design partner and we build the gated version with you.
Get early access →Skeptical? Good.
The trust page leads with what we can't certify — and four ways to cheat the gate.
See how to cheat it →Beyond code
A paralegal checks that every fact in an intake summary traces to a document in the file. An adjuster checks that a claim's evidence was actually collected, not assumed. Neither of those is code — but both are a list of checks, and anything that can be written down as checks can be gated the same way. The result arrives with the record of what was checked, and what wasn't.
We run this on our own tax filings. On the paths that check it, an extracted figure that can't point to the words it came from is dropped before it ever reaches the math.
Facts need the same chain code does. Survey is the record format for it: an extracted value stays tied to the page it came from, the alternatives that lost, and the reviewer who decided — so an answer built on it can show what it stood on instead of asking you to trust the tone.
Early access
We're building in public. Drop your email for build updates and an early look — or start a design-partner conversation: bring a real process, and we build the checkable version of it with you.
Developer? Two commands — install the engine, verify a receipt — on the developers page →