Your AI agent can write the code. runhmd makes it prove it. It tries to break the work and says PROVEN only if the work survives. If not: DENIED, with the case that broke it. You merge. It never does.
A check that can't fail proves nothing, so every gate is shown to fail before it is trusted to pass.
Zero-install npx runhmd attack <your-repo> is coming. Today: install below, then hmd demo.
runhmd puts verification gates in front of AI coding agents. It does not write the code, and it does not take the agent's word for it.
That is a claim, not evidence. Claude Code today; Codex, Cursor and any plain git diff are coming.
Checks the work cannot pass by claiming success: a mutation oracle, replay of every failure that ever shipped, a secret scan, lint and tests.
DENIED blocks the push and shows the case that broke it, so the agent can fix it. PROVEN means every gate passed. A human merges; runhmd never does.
hmd demo is the guided first run: it stages a deny, a fix and a pass. Without --run it only prints the plan and changes nothing; with --run it builds a real full-stack task end to end.
Installs hmd, the gates and the cloud client. It is pinned to a release tag and checked against a published sha256, so if the bytes do not match, nothing runs.
It does write outside the repo: your shell profile, your Claude Code settings and, on macOS, a nightly LaunchAgent. The full list, and how to remove it →
curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.4.10/install.sh -o heimdall-install.sh \
&& echo "81617bcbc21d990955948b3cd7f24c9bd4935a32271fd387c2e3fc416e7d2b3e heimdall-install.sh" | shasum -a 256 -c - \
&& bash heimdall-install.sh
Not published yet, so there is no number here. When there is, it lands on this page with the task list (registered before any agent ran), every raw result — including where runhmd missed or was noisy — and a script to reproduce it. If the catch rate is weak, that is the finding.
Three things you can check today, each with its source.
The cloud maintainer read a real issue, fixed it, proved it with the gate and opened a PR on real Cloud Run and Firestore. A human merges it; the bot can't. The receipt →
Every cross-tenant attack has a named invariant and a red-line mutant test. Drop a gate and the suite goes red. The attack matrix →
The real bugs found while bringing it up, the failing rows of the flagship eval and the corpus dip log are written up, not hidden. Read the bring-up →
The proof is the product. These are the ways to put it to work.
Locally, the gates run on your machine through hmd. In the cloud, a maintainer clones your repo and fixes the issue with your own Claude subscription. Today, cloud onboarding uses an enroll token your admin issues. The three commands →
Hand it an issue before you leave. It comes back as a PR with the evidence attached, on its own branch, never on main. It cannot merge. What lands on your repo →
Status, the agent's questions, a deny button and a short notification when it matters. Not a terminal. What's built, what's coming →
The phone app answers one question: what needs me? As of October 2026 the app and hmd's side of it are built and tested on hmd's main branch, but not in a tagged release, so the install above does not include them yet. Invite-only while we work with design-partner teams.
Not a terminal: no shell, no remote allow, no merge from the phone. How it is secured →
None of the below ships in the current build. It is fenced off on purpose, so what you install is only ever what is proven. The full roadmap →
npx runhmd attack <your-repo>: try it on a repo with nothing installed and nothing written to your machine. Today: the verified install above.
One comment per PR, updated in place: PROVEN or DENIED, with the counterexample and a link to the receipt.
A shareable page for every verdict: gates passed and failed, counterexamples, agent and model, cost and duration.
Codex and Cursor adapters, and a fallback for anything that produces a git diff or a PR. Today: Claude Code.