Your tests share your code's blind spot. Here's the fix.
Somewhere in your codebase there is a function whose tests are green and whose behavior is wrong. Not loudly wrong — quietly wrong, on inputs nobody enumerated, under a reading of the intent nobody knew was a reading. If you lead an engineering team in 2026, you carry that suspicion daily. When Anthropic measured 400,000 sessions of its own coding agent, each human prompt set off around ten model actions and roughly 2,400 words of output (Anthropic, June 2026) — nobody is reading all of that. The green checkmarks have stopped meaning what they used to.
The suspicion is correct. It is also not a failing — not yours, not your team's. It is a structural property of how the code and its tests are produced. And it has a structural fix.
Why more tests don't close the gap
Take a function whose docstring says convert gallons to litres. Four models, asked independently, implemented the US gallon — silently. No error, no comment, green tests. There are two gallons, US and imperial, almost 20% apart. And the docstring was not even mute on which: litres is the British spelling — a developer who writes litres rather than liters plausibly means the imperial gallon. The models defaulted to US anyway. The defect is not in the arithmetic. It sits in a question nobody knew was open — and the prior did not just fill the gap, it overrode the one clue the docstring gave.
Where does such a helper even come from in 2026? Nobody writes convertToLitres(gallons) by hand and asks a model to fill in the body. It appears mid-chain: a story says the UK market wants consumption in litres, an agent decides a conversion belongs here, and function, docstring, body and tests arrive in one pass — the unit question resolved, silently, three levels below anything a person looked at. The one human checkpoint left is the pull-request review, and this line is built to slip through it: a teammate — in Sofia, not in London — sees return gallons * 3.785, recognizes the number from somewhere, and approves. The line looks too trivial to be wrong. Triviality is the camouflage.
A test can only interrogate a question its author thought to ask. When tests and code are written from the same reading of the intent — increasingly by the same model, in the same pass — they agree with each other by construction. Green means consistent with the shared reading. It does not mean correct. And writing more tests from inside that reading adds volume, not scrutiny: the hundredth test knows exactly as much about the second gallon as the first one did.
Why a second AI opinion doesn't either
The reflex is to point another model at the code. But a reviewer that derives its opinion from the code inherits the code's blind spot: whatever was misread during writing gets misread the same way during review. And pushing a model to reason more like a reviewer makes its verdict less reliable — in a 2025 study across three frontier models, requiring an explained verdict with proposed fixes collapsed conformance accuracy in one case from 52% to 11% (Jin & Chen, ASE 2025). The verdict cannot be a model's to give.
A standard the code cannot contaminate
An independent check needs a reference the code did not shape. agetra derives one from the stated intent — the function's signature and docstring — without ever reading the body. From that intent alone it proposes a standard: concrete, executable properties the behavior has to hold. The standard is then frozen, and the code is fired against it on CPU, deterministically — same inputs, same verdict, every run. A model is involved exactly once, to propose. It never judges.
Two things follow. Because the standard never saw the implementation, it cannot have inherited the implementation's mistakes — the contamination your own tests carry by construction is cut. And because the derivation reads nothing but the signature and docstring, that is also the only thing that ever leaves your machine: a body-free description of intent. The implementation stays local.
The verdict comes back in three states — conforming, diverging, can't tell — per behavioral clause, not as a score. Where it has teeth, it says so. Where it cannot decide, it says that, instead of guessing. And it is conservative on purpose: a clause it doubts is dropped, not fired — the record admits a gap honestly in its stated limits, while a false alarm would only teach you to ignore the red.
What the fix cannot do — and what happens instead
It would be convenient to stop here and call the standard unbiased. It is not unbiased. It is differently bounded — and the difference is worth stating exactly, because it is the honest core of the method.
Your tests are bounded by the priors of whoever wrote the code, human or model. A code-blind standard is bounded by the model's priors over the docstring: shown parses a date string, a model will tend to read ISO 8601, because that is the dominant reading — possibly the very assumption the body was written under. Repeating the derivation and keeping only what independent model families agree on narrows that exposure, but cannot close it: consensus measures agreement, not truth. A reading universal enough to be shared by every model survives every vote.
So agetra does not answer the question what was meant? Nothing can — not more models, not higher agreement. What it does instead is freeze what was assumed and turn it into the one question a person can actually answer: was this what you meant? The contract lists the readings the derivation committed to, as named assumptions — read "date string" as ISO 8601 — and the record prints the input space that was actually explored. A shared prior is silent in the verdict; in the record, it is in writing. One bound on that, stated rather than hidden: the enumeration itself shares the prior blind spot — a model does not list a reading it never experienced as a choice. Deriving across families widens the union; that is structural pressure, not a guarantee. Measured on the gallon, though, the anchoring derivations did state their reading in plain words — the standard US gallon to litre conversion factor — the commitment was there to freeze.
That inversion carries the method. Ambiguity stays invisible — to experts most of all — until a concrete reading is put in front of them. Even the everyday vocabulary conspires: Europeans casually call US units "the imperial system" — the imperial gallon being precisely the one the US does not use. The gallon docstring looked obvious to everyone and everything that touched it; the moment assumed the US gallon is stated, anyone who knows the domain sees the error. Recognizing a wrong reading is cheap. Divining an unwritten one is impossible. And note that the reviewer in Sofia recognized something too — the constant, not the reading. Recognition protects you only when it is pointed at the reading.
The same place yields a second instrument. The derivation is repeated; where the intent is thin, the repetitions disagree — and the disagreement is itself reported, as a measurement of how underspecified the intent is. A docstring that cannot be read stably is not noise in the process. It is the finding: the check shows you where "what we meant" was never actually written down.
Run the arc back over the gallon, plainly. When repeated readings split on a clue like this, the check stops and forces the question — that is the designed good case. We fired the derivation at this exact docstring, nine runs across three model families, to see which case the gallon actually is: no reading split. Every derivation that anchored chose the US gallon; the British spelling swayed none of the nine. So on its own flagship example, the honest branch is the conceded one: the verdict comes back green, and stays silent. A misreading shared by every model and questioned by no one is not detected — not here, not anywhere. What remains is not detection, and it is not nothing: assumed the US gallon stands in the record, next to the name that confirmed it. The day the UK complaint arrives, the cause is one lookup in an attributable record, not an archaeology dig through a year of diffs. That is what "fix" means here, stated exactly: not every wrong reading caught — every reading owned, in writing, by someone with a name.
What it asks of you
Where the check cannot decide, it stops and asks — a named person, a concrete question. Answering costs recognition, not authorship: you confirm or correct a stated reading; you do not write a formal spec from a blank page. Each answer is frozen into the next version of the intent, attributed and on the record. Over time the intent accumulates exactly the human decisions the first generation pass never contained.
The reading load does not scale like a review queue, either. Enumerated readings are not something you discover by rereading green reports: they are put in front of you once, when the intent's version is ratified — the verdict's color plays no part in that. A confirmed reading binds to that version and is frozen — re-runs reuse it, and the question only returns when the intent changes. A person is forced in only where the repeated derivations disagree; everything else rides along in the record, on file for the day one of them matters. And the nod itself changes: a review approval vanishes into a timeline; a confirmed reading carries a name.
This division is not a hope; it is already how the work splits. In the same 400,000-session measurement, people made about 70% of the planning decisions and the model about 80% of the execution decisions — and what predicted a successful outcome was command of the domain, not a coding background (Anthropic, June 2026). Anthropic's analysts even rate a user's expertise partly by what they ask the agent to verify.
That is the division of labor worth keeping. The machines write the code and interrogate the code. What stays human is the scarce part — deciding what correct means, one confirmed reading at a time — and the record shows the decisions were yours.
Why this matters now
From 9 December 2026 the EU Product Liability Directive treats software as a product, and on sufficiently complex systems the burden of proof can shift toward the maker. If that side of the question is also yours, it has its own subject, Legally Defensible Code (a companion dossier, in preparation). And what a diligence record contains, field by field, is the auditor's dossier: Audit AI-generated code →
Scope & status
agetra is pre-launch. Version one verifies pure, deterministic Python logic — functions whose output depends only on their inputs. The boundary is detected, not assumed: code with side effects (I/O, clocks, randomness, global state) is marked out-of-scope rather than silently covered. The method — intent in, body-blind standard out, deterministic verdict — is not Python-specific; version one's promise deliberately is. If green-but-not-trusted describes your codebase, join the waitlist. The body of your code never leaves your machine.
Frequently asked
Why do my tests pass but the code is still wrong?
Because the tests and the code were written from the same reading of the intent — often by the same model, in the same pass — so they agree by construction. A test can only ask a question its author knew was open. In one measured case, the docstring said convert gallons to litres; four models silently implemented the US gallon, tests green — although litres is the British spelling, hinting at the imperial gallon, nearly 20% larger. Nothing flagged the choice. Green means consistent with the shared reading — not correct.
Is this just another AI checking AI?
No — but not for the reason you'd expect, and the honest version is stronger than the marketing version. A model is involved: it proposes the standard, once, from the signature and docstring, without reading the body. Because it never sees the implementation, it cannot inherit the implementation's mistakes — which is what an LLM code review cannot say of itself. What it does carry is its own priors over the docstring: shown parses a date string, a model tends to assume ISO 8601 — possibly the same assumption the body-writing model made. Deriving across multiple model families and keeping consensus narrows that, but consensus measures agreement, not truth; a universal prior survives every vote. So the standard is differently bounded, not unbounded: your tests carry the code author's priors; the standard carries the model's priors over the stated intent. agetra does not hide the difference — it freezes each reading into the contract as a named assumption and asks you the one question a person can actually answer: was this what you meant?
If the model's prior fills the gap, won't the check just agree with the bug?
In the verdict — yes. The page above says it without cushioning: a reading universal enough that every model family shares it produces a green verdict and no question, and no consensus at any depth detects it, because consensus measures agreement, not truth. What remains is the honest product, in three parts. Where the repeated derivations split instead of agreeing, the check stops and forces a named person to decide — that gate catches every ambiguity the families do not share. Every reading, forced or not, stands in the contract in writing, with the name that confirmed it. And when reality later disagrees — the complaint from the market whose gallon it wasn't — the cause is a lookup in an attributable record, not an archaeology dig. Detection of a universally shared misreading is claimed nowhere; owned, retrievable commitments are.
What happens when the check can't decide?
It says so — can't tell is one of its three verdict states, not a failure to paper over. It stops, states what was ambiguous or unreadable, and asks a named person to resolve it: confirm or correct a concrete, stated reading. The resolution is frozen into the next intent version, attributed and on the record. Instability across repeated derivations is itself reported, as a measurement of how underspecified the intent is — often the first genuinely useful output, because it shows where "what we meant" was never written down.
Does my code leave my machine?
The body — the implementation — never does. What crosses is a body-free description of intent: the function's signature and docstring, from which the standard is derived. The verdict then runs locally on CPU against the frozen artifacts. This describes what the check reads and sends by construction; it is not a blanket security guarantee.
Do I have to write formal specs first?
No. The check starts from what you already have: signatures and docstrings. Where they carry enough intent, a standard is derived from them; where they are too thin, the check does not pretend otherwise — it reports the underspecification and asks confirmable questions. You answer by recognizing readings, not by authoring a spec language. Each answer sharpens the intent on record; that accumulating precision is the point, not a prerequisite.
What can it verify today?
Version one: pure, deterministic Python logic — functions whose output depends only on their inputs. The boundary is detected rather than trusted: code with side effects (I/O, clocks, randomness, global state) is marked out-of-scope, not silently included. The method is language-agnostic; the version-one promise deliberately is not.