Behavioral verification for AI-written software

Run both systems. Find the first behavior that changed.

Strust executes legacy and migrated software on the same workloads, isolates the first behavioral divergence, and returns evidence to the coding agent and human reviewer. Starting with COBOL-to-Java migration.

Try the interactive demoBecome a design partner

Stage

V1 demonstrator

Evidence

10 controlled scenarios

Method

Open technical paper

Status

Seeking design partners

Interactive v1 demonstrator

Agent + reviewer views

One change. The agent fixes it; the reviewer decides it.

Agent view isolates the first changed decision and the next patch. Reviewer view translates that evidence into impact and a human decision. This controlled example illustrates the intended product loop; the published paper documents the current evidence and limits.

COBOL to Java

Agent receives

Trace-local cause, the first divergent decision, a suggested patch, and the exact rerun command.

Agent diagnosis / F-02

12 divergent traces

First divergence: Branch action

Batch branch B-17 / null-account path · Trace 417 / 1,215

Cause isolated. Patch the changed branch and rerun.

Reference system

COBOL

IF ACCOUNT-ID = SPACES

NEXT SENTENCE

ELSE PERFORM WRITE-CLAIM

END-IF

Candidate system

Java

if (accountId == null) {

writeFallback(claim);

} else { writeClaim(claim); }

batch.advance();

Execution checkpoints

Source value / target value

  1. NULL

    Account input

    NULL

    Equivalent

  2. TRUE

    Guard B-17

    TRUE

    Equivalent

  3. SKIP_WRITE

    Branch action

    WRITE_FALLBACK

    Origin

  4. 0

    Rows emitted

    1

    Changed

  5. 4,808

    Batch count

    4,809

    Changed

First divergence

The first changed decision is Branch action: the source returns SKIP_WRITE while Java calls writeFallback.

Capture → Compare → Isolate → Patch → Rerun

02

Use the lightest check that can answer the question.

Change criticality

Selected feedback

Add replay and broader input coverage.

4/ 5

  1. Types + static analysis

    Global invariants

    Immediate

  2. Expect-style examples

    Readable behavior

    Milliseconds

  3. Deterministic replay

    Controlled time + effects

    Seconds

  4. Property + fuzz checks

    Input exploration

    Selective

  5. Historical + formal checks

    Highest assurance

    Critical paths

Evaluator firewall

The agent does not grade itself.

Strust separates implementation changes, eval changes, and new expected behavior. If a patch changes both the code and the rule judging it, that decision is surfaced for human review.

Implementation diffEval diffHuman approval
03

An eval is a readable example of intent.

.strust/evals/null-account-output.evalRepository eval case
case "null account emits no row"

risk critical
input account_id = null
expect rows = 0
expect effects = []
owner payments-platform

Text first

The test is also the explanation.

Each case records why the behavior matters, the controlled input, expected outputs and side effects, its owner, and its criticality. Humans can read it. Agents can act on it.

Survives after the reference system is retired

CLI

strust eval --changed

Agent tool

Focused failure context

CI

Risk-sensitive gates

Pull request

Behavioral diff

04

Migration was the first proving ground.

First product laneCOBOL → Java
COBOL — observed
01 CUSTOMER-CODE PIC X(8).

IF CUSTOMER-CODE = 'VIP'
  MOVE 'PRIORITY' TO QUEUE-NAME
Java — converted
String code = record.customerCode();
if (code.equals("VIP")) { // ← flagged
  queueName = "PRIORITY";
}

A legacy system is already an executable reference. Strust turns representative source behavior into evals for the system replacing it. Here, COBOL pads the shorter fixed-width value; Java treats VIP····· and VIP as different strings. Both compile; the behavior changes.

✓Capture the source system as executable behavior
✓Review each source-to-target divergence
✓Keep approved cases for every later change
Read the original migration research
05

Built by an engineer obsessed with where behavior diverges.

George Weale, founder of Strust

George Weale

Founder · San Francisco Bay Area

Founder-led prototype

Turning agent quality into evidence a reviewer can trust.

George works on agent quality and efficiency at Google Cloud AI, with a systems background spanning evaluation, inference, GPUs, compilers, and runtimes.

He built Strust around a practical gap: coding agents can produce large migrations quickly, but teams still need independent evidence that the new system preserved the behavior that matters.

The public v1 paper publishes the method, ten controlled scenarios, the known failures, and the limits of the current demonstrator. Strust is now looking for real migration workflows to turn into design partnerships.

About GeorgeRead the v1 paper
Google Cloud AIColumbia MSOpen methodology

Seeking design partners

Bring one real migration into the loop.

Strust is looking for engineering teams, modernization firms, and coding-agent builders with an important software change to verify. Bring the workflow; we will map the behavior that matters and show where the candidate diverges.

Become a design partnerTry the interactive demo