Strust CLI · developer preview

Code with an agent. Ship with evidence.

Strust is a Codex-style coding agent with an independent behavioral evaluator built into the CLI. Make the change, replay the old and new software on the same inputs, and return the first divergence to the agent before review.

See the evaluator loop ↓
strust · billing-migration

› Replace the legacy invoice rounding path without changing customer totals.

01Agent edits candidateDone
02Evaluator replays 128 cases128/128
03Compare observationsDiverge
First changed decisionCase 041

HALF_EVEN → HALF_UP

Same input. Different branch. One-cent ledger change.

Independent evaluatorEvidence retained · replay ready

Agent

Interactive TUI + exec

Evaluator

Independent process

Models

OpenAI + custom providers

Built on

Open-source Codex

01

From agent request to verified change.

The agent proposes. The evaluator observes. You decide.

  1. 01

    Open the repository

    Run strust and describe the software change you need.

  2. 02

    Agent changes the code

    Use your selected model and provider inside the Strust TUI.

  3. 03

    Evaluator compares behavior

    Replay the reference and candidate on the same inputs and contract.

  4. 04

    Repair or review

    Return the first divergence to the agent; retain the evidence for review.

One command surfacestrust 0.9 preview

$ strust

interactive coding agent opens in this repository

$ strust verify --contract strust.toml

DIVERGE · first changed decision at checkpoint 17

$ strust replay finding.json

exact evidence replayed for agent and reviewer

One terminal, two judgments

The agent cannot certify its own work.

Keep the fast coding-agent workflow. The evaluator separately owns the reference, comparison policy, and retained evidence, then gives the agent a concrete finding it can repair and replay.

AgentTUI, exec mode, tools, MCP, skills, and providers
EvaluatorBaselines, verify, replay, minimize, and regression location
EvidenceFindings, receipts, history, and exact rerun commands
Get the developer previewTry the evidence demo

Interactive v1 demonstrator

Agent + reviewer views

One change. The agent fixes it; the reviewer decides it.

Agent view isolates the first changed decision and the next patch. Reviewer view translates that evidence into impact and a human decision. This controlled example illustrates the intended product loop; the published paper documents the current evidence and limits.

COBOL to Java

Agent receives

Trace-local cause, the first divergent decision, a suggested patch, and the exact rerun command.

Agent diagnosis / F-02

12 divergent traces

First divergence: Branch action

Batch branch B-17 / null-account path · Trace 417 / 1,215

Cause isolated. Patch the changed branch and rerun.

Reference system

COBOL

IF ACCOUNT-ID = SPACES

NEXT SENTENCE

ELSE PERFORM WRITE-CLAIM

END-IF

Candidate system

Java

if (accountId == null) {

writeFallback(claim);

} else { writeClaim(claim); }

batch.advance();

Execution checkpoints

Source value / target value

  1. NULL

    Account input

    NULL

    Equivalent

  2. TRUE

    Guard B-17

    TRUE

    Equivalent

  3. SKIP_WRITE

    Branch action

    WRITE_FALLBACK

    Origin

  4. 0

    Rows emitted

    1

    Changed

  5. 4,808

    Batch count

    4,809

    Changed

First divergence

The first changed decision is Branch action: the source returns SKIP_WRITE while Java calls writeFallback.

Capture → Compare → Isolate → Patch → Rerun

02

Migration was the first proving ground.

First product laneCOBOL → Java
COBOL — observed
01 CUSTOMER-CODE PIC X(8).

IF CUSTOMER-CODE = 'VIP'
  MOVE 'PRIORITY' TO QUEUE-NAME
Java — converted
String code = record.customerCode();
if (code.equals("VIP")) { // ← flagged
  queueName = "PRIORITY";
}

A legacy system is already an executable reference. Strust turns representative source behavior into evals for the system replacing it. Here, COBOL pads the shorter fixed-width value; Java treats VIP····· and VIP as different strings. Both compile; the behavior changes.

✓Capture the source system as executable behavior
✓Review each source-to-target divergence
✓Keep approved cases for every later change
Read the original migration research
03

A benchmark for whether migration agents preserve behavior.

SemaMig-Bench · Benchmark v1

Run the source. Run the migration. Score the behavior.

SemaMig-Bench turns COBOL-to-Java migration into a paired, held-out evaluation. The same workload runs against the executable source and native Java candidate; a task passes only when the contract-relevant observations agree.

Open benchmark paper

Protocol

Published

Five-page design and preregistered evaluation protocol

Task corpus

In construction

50 tasks planned across diagnostic, workflow, and system tiers

Leaderboard

Results forthcoming

Baseline scores publish after the v1 corpus and verifiers are frozen

Contact

Have a software change Strust should verify?

Tell us what you are changing and what behavior must stay the same.

Contact us