home

Verify it yourself

Nothing here asks for trust. The steps below rebuild the evidence on your machine. None needs a Token Factory key, and none spends money.

1. Replay the immich run

git clone https://github.com/corupta/architecture-cleaner architecture-cleaner
cd architecture-cleaner
npm ci
npx ac demo --replay

It fetches immich at the pinned commit 02063972e8, replays Nemotron's plan from the committed cassette and checks its sha256 against the recorded run, re-executes the move steps with the executor, commits each one and compares its tree with the recorded run's, static-certifies a sample of the commits, and replays the findings narration. It writes a summary that says what was re-executed, what was replayed, and what was not re-run, and exits 0 when everything it compared matches the recorded run.

It works in /tmp/ac-demo/ (your system's temporary directory) and prints where its summary is. It doesn't use ./ac-demo inside the clone: the clone's node_modules and package.json are above it, and TypeScript and Node look both up from every tree the certifier checks, so a certificate made there would depend on them. The certifier refuses such a directory, and so does the demo's --work.

Without immich's node_modules, K0, K1, K2, K3a, K4 and K7 run on the sample, and each must give the recorded certificate's status. K3b, K3c and K6 skip, and the summary reports them as not compared, with the checks' content and the digests. What it does not re-run by default: the oracles (tsc, the unit suite, the OpenAPI spec) need immich's node_modules and Node 24.21.0; the README's full reproduction sets both up. Add --env <an immich checkout with node_modules> and every check runs on the sample: each check's content and each certificate's digest are compared with the recording, byte for byte. Add --oracles as well and the whole PR is certified with the oracles, its digest compared with the recorded one. No --work is needed. Or add --full to run the whole ladder with ac run (1 h 55 m on a quiet machine in S6).

On 2026-10-23 we ran npx ac demo --replay --env --oracles from a fresh clone, with no --work (20 m 32 s, exit 0): the three sample certificates and the whole-PR certificate came out with the recorded digests, byte for byte.

2. Certify any diff

npx ac certify <immich clone> <base>..<head> --profile immich
npx ac certify <immich clone> <base>..<head> --profile immich --oracles --env <checkout with node_modules>

The certifier is a separate process from the executor and accepts any two commits: ours, a hand-made restructure, or an agent's. Its digest covers the two trees, not commit ids, so a certificate stays valid when its trailers are added by amending the commit.

3. Rebuild this site

npx ac site --out _site

The build reads only committed files (runs/*/, runs/g3/, bench/results/, bench/experiments/s8b-super-vl/, budget/ledger.jsonl) and writes the same bytes every time. A run report can be rebuilt on its own with npx ac report runs/<name> --out <dir>.

4. Read the raw evidence