The tech stack

Measurement lives in Rust. Judgment lives in Haskell. One versioned wire connects them. This is the boundary set by ADR-002 and kept load-bearing by ADR-008: parsing, extraction and indexing stop before policy; score, ratchet and authorization stay in the core.

coreGHC 9.14.1

wireNDJSON · proto 7.1.0 · SemVer negotiation

evidenceOpen the complete evaluation dashboard

Detailed CodeEraser stack: the Rust measurement plane, NDJSON wire and twelve judgment families, Haskell judgment core, five product faces, and the SHA256 release pin chain — The component map. Every box names an implementation boundary found in `cli/`, `core/`, `gui/`, `plugin/`, `contracts/`, or the release workflows. Open the full-size SVG.

What holds it honest

It gates itself

On every push, ci.yml runs six product legs over this repository: scan, dedup ratchet, check at floor 939, deadcode, docdup and erase.

The ratchet only shrinks

ADR-006 freezes per-file ceilings and discrete violation sets in ce-baseline.json. Growth needs a named re-establish; ordinary cleanup tightens the bank.

Lines are declared, per path class

ce.toml's [[rules.class]] gives one glob set its own size and complexity lines and its own ratchet allowance, at most 64 classes, first declared match wins. The score, the ce scan ladder and the guard hook read the file's own line. Class names and globs never cross the wire: what crosses is the class index, its knobs and the knobsDigest of the whole parsed config. The scoring section lists the columns.

Documentation has owners

docs_gate.rs generates CLI and configuration references from the binary. Citation, navigation and constant tests check the methodology. Benchmark surfaces are byte-gated from one JSON contract.

False-positive discipline

classifier: 0/600 flagged (gate <= 1%); write probe: 0/630 false positives. Every other class stays observe. Each promotion is recorded in the CHANGELOG ledger.

Erase is deterministic

erase/gather.rs assembles facts; CE.Erase authorizes only rows that satisfy the safety predicate. Apply verifies every target hash first, then re-runs the source families; a surviving verdict fails loudly. No LLM writes a replacement.

Release has two phases

release.yml hashes draft assets, then committed pins bind those bytes. The tag job downloads the same assets, checks CI and every pin, and publishes without rebuilding. The same pins project the Homebrew formula and the winget manifests, and verify-publish fast-forwards the release branch the plugin marketplace tracks.

The method is inspectable

The fifteen-booklet methodology links every formula to its implementing file:line. docs_citations.rs checks the ledger; docs_nav.rs checks the booklet set and navigation.

Haskell carries decisions

The core alone computes score and ratchet verdicts, authorizes erase rows, and decides cycle-axis membership. Property batteries perturb those decisions and compare small cases with reference implementations.

Trace the boundary in ADR-002 and ADR-008, the wire in contracts/VERSIONING.md, and the verdict formulas in the methodology index.