Loom Download for macOS

A working tree is not a pull request.

Six sessions finish and hand you a working tree: dozens of changed files, no commit boundaries, and no author left to ask why.

Deal the deck
A fanned deck of soft rounded cards, one card lifted out

Nothing is ever discarded. This deck is a conductor tool, not a shredder.

review-deck / types.ts

Three calls per card: commit, hand back to the conductor, or auto. There is no reject, and an unreviewed file can never auto-commit. Every decision is a token until you press Apply.

A soft cream gate on a blue field with cards queued to pass through it

One pass over the whole change-set.

Every changed file is serialised into one numbered pseudo-diff and sent as a single Opus call under a 140,000-byte cap. A per-file fan-out structurally cannot catch duplication across files.

Booting the review deck

The review deck, running · one card per changed file

Three calls, and none of them is a shredder.

A card resolves to commit, hand back, or auto. resolveAuto folds every verdict an agent can return onto those three — reject included — and an unreviewed file can never auto-commit.

Two soft rounded trays: one stack squared up, one leaning applyDecisions.ts
Agent verdictDeck call
  • "commit"Commit
  • "loom"Hand back
  • "reject"Hand back
  • undefinedHand back
  • unreviewedAuto disarmed
Auto-accept window20,000 ms
0redrawn every 250 ms20,000

Four verdicts in, three calls out — no bin on the board

41 screens read the diff, not the story.

3,854 lines of deterministic rules over the real unified diff. No model, no network, no IO — the same diff screens the same way twice.

A stack of soft translucent plates catching one dark pellet staticScreens.ts
Rules by family41 shipped
  • test-tamper20
  • config9
  • dependency6
  • secret5
  • verify1
What one hit does to the certificate
  • 19cap always
  • 10conditional
  • 12advisory

Budget per pass — 400,000 diff lines · 4,000 files · 10 per rule · 200 findings kept

A skeptic without a repro is only an opinion.

Refuters run on a different vendor than the worker and are paid for a demonstrable defect, not for agreeing. A claimed refutation must ship one shell command; the engine screens it for danger, runs it, and reads the exit code.

Skeptic replyWhat the engine ranAdjudication
refutedrepro exits ≠ 0CONFIRMED
refutedrepro exits 0uncertain
refutedno repro supplieduncertain
unparseablenothing to rununcertain

One branch fails the certificate outright. The other three block PROVEN and can never veto — 9 tests pin all four.

None of this is a claim. It is a test run.

The verification engine is 194 tests across five files. The deck, the island and source control are 198 more across fifteen, in 2.06 seconds.

  • 111staticScreens
  • 36certificate.verify
  • 19verifierAuthor
  • 19verifyPipeline
  • 9skeptics
npx vitest run, 2026-08-04194 total
A soft blue check beside a soft cream cross

A run that wrote nothing fires nothing. A Q&A turn makes no card.

changeSet.ts

An unreadable stance never becomes an approval. Junk in, hand-back out.

deckReview.ts

A bare hand-back writes no rule. ~80% of proposals were rejected.

standingGate.test.ts

“The screens did not run” is not “the screens found nothing.”

verifyPipeline.ts