+
+New authority
++ A function starts writing files, calling a service, or performing + any effect its previous contract did not admit. +
+A function can only do what its signature admits to.
-- Not a lint, not a convention. Deed reads the body, and a function that - reaches for something its signature did not mention is not a program. -
+
+
-
- Contract-first language / local review tool
+Deed tells you when an agent patch gains power.
++ Deed compares the checked contract before and after a patch. It + flags new authority, weaker guarantees, and new runtime checks + even when the tests stay green. +
+ +-
+
- Runs locally +
- Works in CI +
- Available over MCP +
-
+
+
-
+
+
+
diff --git a/tools/check.mjs b/tools/check.mjs
index 51a9dc6..07660dd 100644
--- a/tools/check.mjs
+++ b/tools/check.mjs
@@ -195,6 +195,22 @@ if (deed) {
) {
complain("agents/", `the review demo says regressions are ${JSON.stringify(receipt.tier_regressions)}`);
}
+
+ const landing = await readFile(join(root, "index.html"), "utf8");
+ const landingAuthority = `data-review-authority="${authority?.authority}"`;
+ const landingTier = `data-review-tier="${regression?.before}:${regression?.after}"`;
+ if (!landing.includes(landingAuthority)) {
+ complain("index.html", `does not show the review demo authority ${authority?.authority}`);
+ }
+ if (!landing.includes(landingTier)) {
+ complain(
+ "index.html",
+ `does not show the review demo tier change ${regression?.before} -> ${regression?.after}`,
+ );
+ }
+ if (receipt.clean !== false || !landing.includes("Review blocked")) {
+ complain("index.html", "does not show that the review demo is blocked");
+ }
}
} catch (error) {
complain("agents/", `the pinned artifact could not review the demo: ${error.message}`);
This function saves a file.
-fn keep(files: Dir, name: String, text: String) -> Result<(), String>
- uses
- Io.read,
-{
- match Io.read(files, name) {
- ok(_) => ok(()),
- err(_) => Io.save(files, name, text),
- }
-}
+
+
+
+
+
+
+ - uses Store.read
++ uses Store.read, Store.write
+
+
+ Review blocked
+-
+
- New authority +
- Store.write +
- Weaker promise +
- proven -> guarded +
- Tests +
- may still pass +
+
+
+
+
+
+ + Produced from the pinned Deed compiler. + Open the full receipt. +
+What the receipt names
+Review the change tests do not name.
+
+
+
+
+
+
+
+ -
+Weaker guarantees
++ A promise that was proven at compile time now depends on a test + or a runtime guard. +
+?
+New uncertainty
++ The patch leaves a new obligation for runtime and says why the + checker could not settle it earlier. +
+
-
+ Its signature only admits to reading one.
-error[DEED5001]: `keep` performs `Io.save` without declaring it
- --> main.deed:3:4
- |
-3 | fn keep(files: Dir, name: String, text: String) -> Result<(), String>
- | ^^^^ add `Io.save` to the `uses` clause
- |
- = note: a function can only do what its signature admits toOne boundary, three readers
+Write the rule once. Let code, CI, and agents read it.
-
+
-
+ 01
+ + The signature states the authority. ++
The body is refused if it reaches for anything wider.
+
+ -
+ 02
+ ++
deed reviewcompares two checked trees. +New authority and weaker tiers become structured evidence.
+
+ -
+ 03
+ + CI chooses what must block a merge. ++
Each review signal has its own independent policy gate.
+
+
- That list has a name, an effect row, and it is part of the type. It is - checked in both directions, so a row that claims authority the body - never uses is an error too: a signature is only worth reading if it is - tight. Nothing is ambient. If a function can touch the filesystem, it - was handed the filesystem, and you can see that from the call. -
+
+
+ Underneath the receipt
+A small language, not another policy file.
++ Deed checks types, effects, capabilities, contracts, and the code + that must satisfy them. Nothing is ambient. If a function can + touch the filesystem, the filesystem appears in its inputs and + the operation appears in its signature. +
+ See one clause become a boundary +fn keep(files: Dir, name: String, text: String)
+ -> Result<(), String>
+ uses Io.read,
+{
+ match Io.read(files, name) {
+ ok(_) => ok(()),
+ err(_) => Io.save(files, name, text),
+ }
+}
-