anvil

// GENERATION_TIME_TRUST

TRUST THE CODE
YOUR AI WRITES.

anvil is the independent, deterministic control point for AI-assisted software engineering.

The agent proposes a write. anvil checks it against deterministic policy before it reaches the diff, and the agent hears the answer while it can still fix the work. The judge is never the model that wrote the code.

Understand the change. Apply your standards. Stop unsafe work before it reaches review.

$request access
read the docs
anvil :: pre-writeagent → anvil → diff
[ = ]▊
[ = ]LOCAL EXECUTION
[ = ]DETERMINISTIC POLICY
[ = ]RESIDENT GRAPH
[ = ]12 MCP CLIENTS

current release v0.11.1-beta :: checks run on your machine :: no source upload required

// THE_TRUST_GAP

AI CAN CREATE MORE
THAN HUMANS CAN REVIEW.

AI increases how much software an organisation can produce. It also increases the distance between the people responsible for a system and the actions taken on their behalf.

After an unsupervised hour you cannot reconstruct what happened from the agent’s own account. The model is inclined to approve its own work, the rules you gave it may have dropped out of its context, and reading the raw logs back is a cost nobody pays.

Logs record what happened. Evidence shows what was true. Policy states what was required. Nothing in the usual toolchain puts those three together for a single change and says whether it deserved to be trusted.

REVIEW_CAPACITY
output outruns the people responsible for the system
SELF_REPORT
the system that created the work cannot judge it
SILENT_HOUR
non-conforming writes land before anyone looks

BABYSIT

you keep up. the agent does not.

UNSUPERVISED

the agent keeps up. you do not.

ANVIL

the agent runs. the write still has an independent judge.

[ = ]

PROTECTION IS THE ENTRY POINT.
DECISION INTEGRITY IS THE SYSTEM AROUND IT.

Today, anvil checks code as it is written and keeps a living model of the codebase beneath it.

That control point is the foundation for a broader system: one that connects the intent behind a change, the evidence for it, the policy that applied, and a durable record of the decision.

// CONSEQUENCE

THE WRITE EITHER HAS A JUDGE,OR IT DOES NOT.

WITHOUTno judge

$ agent write src/auth.ts

skip CLAUDE.md

secret lands in src/auth.ts

the miss arrives at review, or in production

WITHindependent judge

$ agent write src/auth.ts

[ ERR ] secret-detection

write blocked at save-time

agent sees the miss immediately

// DECISION_INTEGRITY

DECISION INTEGRITY
FLYWHEEL

Every decision should make the next one better. Understand, build and decide operate today. Learn, where outcomes feed back into understanding, is still being built.

operating foundation
system being completed
  1. [1] UNDERSTAND↓

    a living graph of the code, and the context that applies

  2. [2] BUILD↓

    the proposed change and the evidence behind it

  3. [3] DECIDE↓

    deterministic policy: block or pass

  4. [4] LEARN↺

    outcomes improve future understanding

// FOUR_STAGES

FOUR STAGES.ONE JUDGE.

Understand, build, decide, learn. anvil is the judge inside that loop. It informs the change and rules on it. It does not write it.

  1. UNDERSTAND

    operating today

    a resident graph of your software: structure, dependencies, symbols and ownership. it is the context for every check, and for your assistant.

  2. BUILD

    operating today

    context, impact analysis and explanation for the humans and agents doing the work. anvil supports the change; the coding agent still writes it.

  3. DECIDE

    operating today

    interception and deterministic policy at the control point. block or pass, the same way every time, by software that did not write the change.

  4. LEARN

    being built

    drift against your baseline is checked today. feeding outcomes back into the next decision is the part still being built.

// DECISION_MODEL

THE SYSTEM THAT CREATES WORK
SHOULD NOT JUDGE IT ALONE.

Every decision is about one specific action. AI can help explain the change, interpret a finding, or fix the problem. Deterministic software makes the final call at the trust boundary, and it is never the model that wrote the code.

This is the model anvil is built toward. Intent and receipts are the stages still being completed; the delivery boundary below draws that line.

INTENT

what outcome was expected

EVIDENCE

what was demonstrably true

POLICY

which constraints applied

DETERMINISTIC DECISION

the independent trust boundary

DECISION RECEIPT

why the action was trusted

// DELIVERY_BOUNDARY

THE CONTROL POINT
SHIPS TODAY.
THE TRUST CHAIN
COMES NEXT.

anvil sits in the workflow as an independent, deterministic judge. The first run is useful with zero configuration. A refusal arrives at write-time, while the agent can still correct the work.

This is the one place on this page where the line between shipped and planned is drawn.

default checks

  • secret-detectioncredentials and tokens never enter the diff
  • command-safetydestructive or unexpected shell is stopped
  • antipattern-scanknown unsafe shapes caught in the proposed write
  • import-boundarieslayer and package rules held at save-time
  • your policyyour own rules, evaluated the same way every time

operating today

  • deterministic checks before a write and at save-time
  • a resident graph of the code, with context served to your assistant
  • built-in checks, your own policy, and enforcement you choose
  • a durable record of what was checked, for review and audit

system being completed

  • checking a change against the intent behind it
  • evidence drawn from the tools you already run
  • decision receipts a third party can verify
  • outcomes feeding back into future decisions

// BUILT_BY_EDDACRAFT

eddacraft
[ = ]

TRUST INFRASTRUCTURE
FOR AI-ASSISTED WORK.

eddacraft builds trust infrastructure for work done with AI: the independent layer that says whether the work can be relied on. anvil is where that starts, with software engineering.

eddacraft.ai