A versioned release
The program users get. Verify the exact bytes that go out the door.
How to use FalseGreen
Verify the program you ship.
One contract — falsegreen.toml — says what your program must do. A FalseGreen Job proves the whole program meets it before it ships.
The unit of work
The contract is the unit.
falsegreen.toml lives in your repository, next to the code. It states what must be true about the whole program. Freeze it before your AI coding agent builds, and success can no longer be invented after the fact.
The scope is the whole program. One file, one program, one verdict.
falsegreen.toml
- [[criterion]]
Commands the machine runs — tests, clippy, builds. The program must pass them.
- [[invariant]]
Claims proved with Kani or Creusot. Not tested — proven, over every input.
- [security]
The five mandatory checks: dependencies, secrets, code patterns, components, licences.
A worked example: the open-source FalseGreen Ledger ships its own falsegreen.toml →
Usage
When teams run a FalseGreen Job.
Verification is bought at the moments a program leaves your protection — the way every human audit, pentest, and certification has always worked.
A port or rewrite complete
Ada to Rust, old stack to new. The contract proves the port kept what mattered.
A customer deliverable
Software you hand to someone else. Ship it with evidence, not assurances.
Before a human audit or security review
Walk in with a machine verdict instead of a promise.
After a serious incident
Re-verify the fixed program. The old verdict no longer describes your software.
Not every commit. The FalseGreen Gate runs on every pull request, free, and stops any change whose exact code a FalseGreen Job did not accept. The Job is the certificate you run when the program matters.
The workflow
From release candidate to verdict.
01
Write the contract
falsegreen.toml states what must be true about the whole program — commands, proofs, security.
02
Freeze it
The contract digest enters the FalseGreen Job boundary. Success can no longer be redefined after the fact.
03
Your AI coding agent builds
It investigates, implements, and repairs — aimed at the frozen contract, not its own opinion of done.
04
Run the Job
Your exact source is published; a deterministic image runs every criterion, proof, and security check.
05
Machine verdict, in minutes
Accepted, Failed, or Insufficient evidence. Evidence decides — not agent confidence.
06
Fix and re-check
Up to seven free re-checks in one price. The implementation may change. The target does not.
At release time
What each verdict means.
Accepted
Merge, tag, ship. The Gate accepts, and the report stands as your evidence — re-checkable at any time.
Failed
The exact failing test, violated rule, or counterexample comes back as repair work for your AI coding agent. Fix and re-check free.
Insufficient evidence
Something was never checked — a proof undecided, a check missing. Never a silent pass. Strengthen the contract and re-check.
Everything between Jobs
Continuous checking is free.
The FalseGreen Gate watches every pull request and checks each change against the same frozen contract, at no cost. You pay once per FalseGreen Job — for the verdict on the exact program you intend to ship.
After the Job
Verify the report yourself.
When your Job reaches a result, you get a report. Before you act on it — or share it — you can verify it yourself, offline, with no trust in FalseGreen required.
3 steps
- 1. Save the JSON report from the Job.
- 2. Run
falsegreen verify-report ./report.json. - 3. The client re-derives the report's canonical form and checks the embedded Ed25519 signature against the embedded public key — offline, on your machine.