Behavioral verifier · product preview

Find the first behavior your rewrite changed.

Strust runs existing software and its AI-written replacement on the same inputs, finds the first behavioral difference, and retains a replayable finding for the coding agent and human reviewer. The first lane is COBOL-to-Java migration.

Inspect the verification demoRead the evidence audit
illustrative trace · billing-migration

› Replace the legacy invoice rounding path without changing customer totals.

01Run approved referenceDone
02Run candidate rewriteDone
03Compare declared observationsDiverge
First changed observationCase 041

HALF_EVEN → HALF_UP

Same input. Different branch. One-cent ledger change.

Independent verifierEvidence retained · replay ready

Reference

Existing executable

Candidate

AI-written replacement

Verdict

Match · Diverge · Inconclusive

First lane

COBOL → Java

01

From two runnable systems to one reviewable verdict.

The reference runs. The candidate runs. Strust keeps the difference.

  1. 01

    Declare the boundary

    Fix the reference, inputs, observations, and comparison policy.

  2. 02

    Run both systems

    Execute the approved reference and candidate on the same inputs.

  3. 03

    Inspect the first difference

    Return MATCH, DIVERGE, or INCONCLUSIVE with retained evidence.

  4. 04

    Repair and rerun

    Change only the candidate, then run a fresh full verification.

Verification contractillustrative output

reference approved

legacy billing executable · contract pinned

candidate evaluated

DIVERGE · first changed observation at checkpoint 17

evidence retained

replayable finding for agent and reviewer

One contract, two executions

The coding agent cannot grade its own rewrite.

Strust works beside the coding tool. A separate verifier owns the approved reference, observations, comparison policy, and retained evidence, then returns a concrete finding the agent can repair and rerun.

Candidate writerAny coding agent, converter, or engineering team
VerifierReference boundary, paired execution, and tri-state verdict
EvidenceFirst difference, receipts, history, and replay data
Inspect the verification demoRead the evidence boundary

Interactive v1 demonstrator

Agent + reviewer views

One change. The verifier isolates it; the reviewer decides it.

Agent view isolates the first changed decision and the next patch. Reviewer view translates that evidence into impact and a human decision. This controlled example illustrates the intended product loop; the v1 paper contains a declared results ledger whose arithmetic is reproducible, while its historical execution artifacts are unavailable.

COBOL to Java

Agent receives

Trace-local cause, the first divergent decision, a suggested patch, and a conceptual replay target.

Agent diagnosis / F-02

1 changed observation

First divergence: Branch action

Batch branch B-17 / null-account path · Illustrative scenario B

Cause isolated. Patch the changed branch and rerun.

Reference system

COBOL

IF ACCOUNT-ID = SPACES

NEXT SENTENCE

ELSE PERFORM WRITE-CLAIM

END-IF

Candidate system

Java

if (accountId == null) {

writeFallback(claim);

} else { writeClaim(claim); }

batch.advance();

Execution checkpoints

Source value / target value

  1. NULL

    Account input

    NULL

    Equivalent

  2. TRUE

    Guard B-17

    TRUE

    Equivalent

  3. SKIP_WRITE

    Branch action

    WRITE_FALLBACK

    Origin

  4. 0

    Rows emitted

    1

    Changed

  5. UNCHANGED

    Batch count

    INCREMENTED

    Changed

First divergence

The first changed decision is Branch action: the source returns SKIP_WRITE while Java calls writeFallback.

Capture → Compare → Isolate → Patch → Rerun

02

COBOL-to-Java is the first test lane.

First product laneCOBOL → Java
COBOL — observed
01 CUSTOMER-CODE PIC X(8).

IF CUSTOMER-CODE = 'VIP'
  MOVE 'PRIORITY' TO QUEUE-NAME
Java — converted
String code = record.customerCode();
if (code.equals("VIP")) { // ← flagged
  queueName = "PRIORITY";
}

A legacy system is already an executable reference. Strust turns representative source behavior into evals for the system replacing it. Here, COBOL pads the shorter fixed-width value; Java treats VIP····· and VIP as different strings. Both compile; the behavior changes.

✓Capture the source system as executable behavior
✓Review each source-to-target divergence
✓Keep approved cases for every later change
Read the v1 evidence audit
03

A benchmark design for whether migration agents preserve behavior.

SemaMig-Bench · Protocol published · Corpus in construction

Run the source. Run the migration. Score the behavior.

SemaMig-Bench turns COBOL-to-Java migration into a paired, held-out evaluation. The same workload runs against the executable source and native Java candidate; a task passes only when the contract-relevant observations agree.

Open benchmark paper

Protocol

Published

Five-page design and preregistered evaluation protocol

Task corpus

In construction

50 tasks planned across diagnostic, workflow, and system tiers

Leaderboard

Results forthcoming

Baseline scores publish after the v1 corpus and verifiers are frozen

Contact

Have a software change Strust should verify?

Tell us what you are changing and what behavior must stay the same.

Contact us