A claim that nothing checks will eventually be false. So I build the things that check.
That is not a slogan I picked. I audited the READMEs of my own repositories one night, by hand, and most of them had a number in them that was wrong — several had been wrong since the day they were written, and always in my own favour, which is the direction these errors go. So I stopped trusting prose, including my own, and started writing tools that hold it to the code.
This page is one of them. The measured number below is bound, in the Markdown, to the command that produces it, and a workflow re-runs that command on every push and once a week. If the number drifts, this profile goes red. It does not get to quietly stop being true.
readme-check — Runs the console blocks in your README and checks that they still print what you promised. A number in your prose can name the command that settles it, in a comment that renders as nothing. It found the wrong numbers in my own repositories first, and it checks its own README with it.
changelog-check — Your CHANGELOG cites a commit hash. This checks the commit is actually in your history. The catch is a subtle one: after a rebase the old objects are still lying around, so the obvious test (git cat-file -e) passes happily while the entry points at a commit nobody can reach.
consent-check — Your cookie banner claims "we respect your choice". This clicks Reject all, then measures what the browser actually does — against the same site's Accept all run, so the site is its own yardstick and there is no argument about what counts as a tracker. It reports facts and evidence, never a legal verdict.
impressum-check — Fails the build when a site is missing a disclosure German law requires (§ 5 DDG, Art. 13 GDPR), and every rule cites the provision it enforces. Deliberately German: it enforces German law, so its rules and its output speak it.
ci-alibi — A green check mark is supposed to mean the tests passed; sometimes it only means the step exited 0. This finds the steps a workflow is structurally incapable of failing on — and it does not pattern-match the script, it runs it under the exact shell GitHub would use, with every command stubbed and one made to fail, then reads the exit code. The case nobody believes: GitHub's implicit default is bash -e without pipefail, so pytest | tee log.txt exits with tee's status and is green however the tests went. Writing its tests turned up five real defects in it, including one that made it judge nothing at all on Ubuntu — all five are in the history.
quote-check — Binds a quotation to a source that can be checked, and fails when a quote is attributed to someone who cannot be shown to have said it. It exists because I put a sentence in a real person's mouth on a page arguing that people should not be deceived. He never said it.
badge-check — Checks that the badges in your README point at this repository and report what they appear to report: a placeholder account, a workflow that no longer exists, a passing rendered over a build that is red. It found eighteen unreplaced your-username placeholders in my own repositories, and behind them nine builds that had been failing unnoticed.
clean-room-check — Runs your README's install steps from zero in a fresh container with nothing preinstalled, and fails when the documented flow does not actually work. It covers the one line readme-check deliberately skips — the install — which is exactly where my own README turned out to be wrong.
link-check — A README says "sources below" and lists ten links; a dead one is the quietest kind of wrong. This pulls every http(s) URL out of Markdown or HTML, requests each, and fails the build on a dead one — example URLs in code fences skipped, HEAD falling back to GET. Standard library only, and its own CI runs it on its own README.
Layer 8 — An encyclopedia of real computer, phone and network faults. Its build runs a set of linters over its own content and aborts when a claim is unbacked — a command that would not work, a fix nothing supports. It refuses to publish what it cannot stand behind. Also deliberately German, because its readers are.
These belong together. The Claim Checkers collects them as one family with a single thesis: the gap between what something claims to be and what it is, made measurable, made a build failure.
ci-alibi-field-report — ci-alibi run over the 100 most-starred repositories in each of Python, JavaScript, Go, Rust and Java that have workflows: 500 repositories, 4,652 workflow files, the corpus frozen before the first measurement. It found 2,075 steps that cannot go red, in 265 of the 500, of which 535 looked like real checks. Then I read the strongest seven against their original YAML: three were artefacts of my own tool, three were engineers doing something deliberate and saying so in the same line, and one was genuine — and even that one has a hand-built safety net two steps later. 535 is an upper bound; the verified floor is one. The sample rates were deliberately not extrapolated back onto the 535, because that is the move that turns a measurement into a press release. The report leads with the two defects it found in the tool itself, including the one that made it judge nothing at all on Ubuntu — and with the fact that it is silent about 61.5% of what it saw.
The tools above run in CI, where only I see them. These are the same idea, deployed — a claim held to the truth in front of whoever visits.
wetter.kaipfstr.de — A weather site that shows its own errors instead of hiding them. Every other weather page prints one number; this one prints the spread — eleven forecast models asked the same question at the same minute, and the gap between their answers — and then back-checks its own past forecasts against what the DWD station actually measured. The five-day forecast that was seven degrees off is still on the page; most apps swap the old forecast for the new one and pretend they always knew. Keyless, no build step, no dependencies: the whole logic sits in three script files, and every number names the source it came from (Open-Meteo for the models, Bright Sky for the measurements, PEGELONLINE for river gauges, the DWD for warnings). Where a source is unreliable — a flood value read off the wrong grid cell, a station 2,000 m below your mountain — the page says so rather than rounding it away. Static on Netlify, MIT-licensed.
tetris.kaipfister.de — Tetris in the browser, and an honest label on it. It used to say "the 1989 Nintendo rules: Super Rotation System, wall kicks, lock delay" — which cannot be, because the SRS is from Tetris Worlds in 2001 and the NES game had neither wall kicks nor lock delay. What it actually is: modern Guideline Tetris with the 1989 gravity table and the 1989 scoring, and it now says so itself. No install, no signup, no framework.
These came first, and they are why the tools above exist: they are the repositories whose READMEs turned out to be lying. No frameworks and no dependencies — the standard library and the problem.
chess-perft — A legal chess move generator in pure Python — castling through check, en passant with its discovered-check edge cases, promotions, pins. Its correctness is not an opinion: it reproduces the canonical published perft node counts to the last digit, up to 119,060,324 leaf nodes at depth 6 from the start position, across the six standard test positions.
game-of-life — Conway's Game of Life, sparse and unbounded, with a terminal animation. Same idea as the chess generator: correctness pinned to numbers other people published decades ago — the R-pentomino settling at generation 1103 into 116 cells, Diehard vanishing at 130, the Acorn at 5206 into 633, the Gosper gun firing a glider every 30 generations. A single mistake in the rule moves those numbers; CI checks them on every push.
rejit — A regular-expression engine (a Pike VM) that matches in guaranteed linear time, so it cannot be ReDoS'd. Against the classic catastrophic pattern (a+)+$, Python's re multiplies its work about sixteenfold for every four characters of input, while rejit's time does not move at all — that shape is the claim, not any one benchmark. Every CI run cross-checks it against re on ten thousand randomly generated pattern/text pairs, asking three questions of each — 30013 assertions, zero disagreements.
tinyjit — A JIT compiler in pure Python that writes real x86-64 machine code into executable memory and calls it. No gcc, no LLVM. 55 is push rbp, and the CPU runs it directly.
x86-disasm — The other half of tinyjit: it turns those bytes back into instructions and is held to GNU objdump's reading of them. One project writes the machine code, the other proves it says what it meant.
nanoclone — git clone, implemented: Smart HTTP v2, packfile delta resolution, a real .git index. Every object is verified against its own SHA-1, and real Git sees a clean checkout — git status prints nothing.
pdb-from-scratch — A debugger in pure Python that sets breakpoints the way real debuggers do: by writing 0xCC into another process's memory via ptrace. Verified end-to-end against a traced C program.
tar-from-scratch — The POSIX USTAR format built and parsed by hand, one 512-byte block at a time, no tarfile. The proof is external: the CI writes an archive with it, hands it to the system GNU tar to extract, and compares every byte back — both directions.
json-from-scratch — A recursive-descent JSON parser (RFC 8259), no json module. Measured against the corpus every JSON parser is measured against — Nicolas Seriot's official JSON Parsing Test Suite — in CI: 95/95 must-accept, 188/188 must-reject.
Also from scratch: btreedb (an on-disk B+ tree), tcp-userspace (a TCP/IP stack real curl talks to), cdcl-sat (a SAT solver whose UNSAT answers ship a checkable proof), minilink (a static ELF linker), deflate-from-scratch, recursive-dns (DNS resolution from the root servers), sha256-from-scratch (FIPS 180-4, proven against hashlib), base64-from-scratch (RFC 4648, checked against /usr/bin/base64), crc32-from-scratch (proven against zlib.crc32), bignum-from-scratch (arbitrary-precision integers, Karatsuba, proven against Python int), csv-from-scratch (RFC 4180, proven against the csv module), zip-from-scratch (archives read byte-identically by unzip and zipfile) and utf8-from-scratch (strict encoder/decoder, proven against Python's UTF-8).
Because a claim should carry its proof even when the thing is small or just for fun.
maze — a perfect-maze generator and solver whose output is proven to be a spanning tree of the grid (exactly w·h − 1 passages, connected, acyclic), so there is exactly one path between any two cells. donut — the spinning ASCII torus, where every sampled point is proven to lie on the torus, (√(x²+y²) − R₂)² + z² = R₁². bloom-filter — zero false negatives ever, and a measured false-positive rate that lands on the theoretical (1 − e^{−kn/m})^k. expr-eval — a tokenizer / shunting-yard / RPN evaluator (no eval, no ast) matching Python's arithmetic on thousands of random expressions. astar — A* pathfinding proven optimal: its cost equals Dijkstra's across hundreds of random grids, with a verified-admissible heuristic. sudoku — solver, uniqueness checker and generator; every solution provably satisfies all constraints and proper puzzles have exactly one. mandelbrot — an escape-time renderer that writes real PGM/PPM images, checked against known facts of the set. tiny-lisp — a small but real Lisp interpreter (reader, lexical closures, define/lambda/let/cond), its arithmetic checked against Python.
Python · Compilers · Networks · Low-level · Würzburg