Blog

Before you ship a risky fix, prove the unsafe baseline, the fix, and a negative control in a scratch prototype that ships nothing.

A trust-root check returned when its file was absent. Learn how to test security controls for missing inputs, not only bad ones.

A passing Ranex gate proves tested conformance to an approved graph and exact digest. It does not prove correctness, security, or performance.

What Ranex Ed25519 evidence signatures prove, what they cannot prove about approval or truth, and how the committed public keyring works.

A passing command for one commit proves nothing about another. Bind evidence to the exact digest or let stale proof stop counting.

A race test passed because its framework ran sequentially. Learn how to prove your concurrency test can fail on broken code.

How the Ranex journal blocks ordinary rewrites, detects edited rows, and where its rollback and truncation limit remains open.

How a retryable timeout can make every watchdog test pass while a stalled provider stream still hangs your session.

GitHub rulesets, editor hooks, and CI gate channels. Ranex asks a separate question: what must the evidence prove?

A real agent can work in a clean worktree without a signing key. See the delegation boundary that yields a candidate, never a self-issued PASS.

Why Ranex fails a required claim with no evidence, including why a fresh clone correctly starts with a failing verdict.

If your agent can author its own success, your checks are decoration. Learn the structural split that keeps a harness from grading itself.

A session report describes a run. Re-run the command against the artifact on disk before you let that description decide anything.

Nine defects appeared only when the Ranex CLI was driven like a new operator would use it. Here is what to test at your tool surface.

HTTP 200 can hide a broken dependency. Reproduce 12 Uptime Kuma monitor results and learn when keyword checks miss what a JSON query catches.

A SQLite file copy passed its integrity check but missed committed rows. Reproduce it, then use the included backup utility and restore verification lab.

Stop an agent from approving evidence it produced. The separation-of-duties rule that still matters when models improve.

A passing uv sync can leave a new dependency uninstalled. Run this small lab to see why, then use the lockfile check that matches your CI requirement.

A valid credential is not proof of what it was about. Learn how six false PASS paths exposed one weak observation boundary.

Week 1 roundup: five verified highlights, five plain corrections, and what we left out, every restated fact re-checked against primary sources.

Five observable GitHub signals (response times, external-PR merges, release cadence) that tell you more than any good first issue label.

Why a Ranex verdict uses only gate, evidence, subject, and approver so the same proof always gets the same result.

What these three releases changed, what to verify before an upgrade, and a reproducible Gitea startup check with recorded results.

A practical six-check method for examining a newly discovered GitHub repository before your team commits engineering time to it.

Compare three self-hostable Notion alternatives by workflow, export, and maintenance. Use the migration acceptance kit to test your own shortlist.

A signature can prove who made a record, not whether the policy deciding it came from a trusted committed state.

Your AI assistant cited source code, but which exact version? A practical way to check AI source code provenance with primary, verifiable evidence.

A failure sentence cannot reliably carry its category. Keep the cause as structured data, render the prose from it, and block unknown values.

Exit code zero can conceal skipped or missing tests. Freeze outcomes and judge them against a manifest instead.

A GIT_* variable redirected Ranex checks to the wrong repository. Learn the boundary a git flag cannot enforce and the fix that closed it.

Mutation testing exposed 59 refusal paths no test executed. Learn how to measure the safety net instead of trusting a green suite.

A single run cannot prove a change helped. Freeze the comparison, set the rules first, and keep observations separate from grades.

Learn why a stable-looking test report is not evidence, and how rerunning checks against disk exposed a 12% flaky suite.

A SHA-256 hash identifies approved dependency bytes. It cannot prove that imported code will report your test result honestly.

A citation can be fabricated from memory. Fetch and record the source bytes before you let a design claim borrow their authority.

Ranex gates Ranex. Here are the real failures that came out of pointing a verification kernel at its own test suite, including the ones that had already passed human review.

Better models don’t remove the need to bound an agent’s authority: they increase it. The case for treating AI as delegated labour that needs an accountability apparatus outside itself.

Ranex judges AI-written work by evidence and executable checks, never by model confidence. Here is the whole mechanism: three ports, one kernel, and only one of them produces a verdict.