Designed to explain, debug and repair. Never to change a spec.
One assistant in the dashboard that will know the current repo, run or obligation.
Talk to us coming soon
01 / ITS JOBS
What it will do, and what it will only propose.
- Explain why a proof fails, in plain language, with the counterexample.
- The agent is designed to propose spec changes and proof repairs; a person confirms each before it runs.
- Explain a patch: which brick, why, and what the differential tests covered.
- Recommend what to prove next, ranked by how provable and how important a function is.
- Debug a failing run: extraction errors, unsupported Rust, cache misses.
You
Why is percent_bounded red?
rustproof agent · run_01HX4K
The claim is r ≤ 100 whenever done ≤ total. The counterexample finder found percent(42_949_673, 42_949_673): done * 100 overflows u32 before the division, so the function fails inside its own precondition.
Three standard resolutions. Widening the intermediate to u64 keeps the theorem exactly as approved, so it needs no new review.
Propose: widen intermediate to u64Propose: precondition done ≤ 42_949_672Open counterexample
02 / SAME RULES AS EVERY SURFACE
It is designed to have the build engineer’s authority, and no more.
The agent is designed to propose; a person confirms each action before it runs. The build engineer (CI) is designed to write and repair proofs; it never changes a theorem, applies a custom brick or moves the proof boundary.
By design, nothing checks a spec except a person.
Ask it why.
Install the Claude Code plugin coming soonRequest early access coming soon