Proof,
not consensus.

Every tool ships with a suite of inputs whose correct outputs are known and fixed. They are not examples and not documentation — they are the thing the build is measured against, and they travel inside the executable.

If a change makes one vector disagree, the build does not ship. There is no discussion about whether the difference matters, because the vector was agreed upon while nobody was under deadline.

Anything that can be decided by a rule is decided by a rule. Address overlaps, impossible ranges, unit collisions, missing scale factors, coverage thresholds — these are arithmetic, not judgement, and arithmetic does not have opinions on Friday afternoon.

AI is used where rules genuinely cannot reach: reading a badly-scanned table, guessing what an ambiguous field name meant, drafting a first test case. Its output enters the pipeline as a proposal and is checked like anything else.

These tools are built for rooms where the network is deliberately absent: classified programs, flight-test benches, fab floors. That constraint is accepted at the start, because retrofitting it later never actually works.

One consequence is that the software cannot phone home for licences, models, updates or analytics. Another is that you can read the whole trust boundary in one sentence: the file you copied, and nothing else.

Approval is only meaningful if the person approving can inspect what they are approving. Every derived value carries its provenance: which page it came from, which rule accepted it, which vector covered it.

That audit trail is also what makes the work defensible months later, in a design review, to someone who was not in the room and should not have to take anyone at their word.