Agents write. Strust verifies.

Strust runs existing software and its AI-written replacement in paired execution, then keeps the first changed behavior as evidence.

See how it worksRead research

At Branch B-17, the reference returns SKIP_WRITE while the candidate returns WRITE_FALLBACK. Strust returns MATCH / DIVERGE / INCONCLUSIVE against the declared contract.

REFERENCE
COBOL / Branch actionSKIP_WRITE
CANDIDATE
JAVA / Branch actionWRITE_FALLBACK
FIRST DIVERGENCE
Branch actionBEHAVIOR CHANGED
Reference
SKIP_WRITE
Candidate
WRITE_FALLBACK

The contract stays fixed while the code changes.

Strust runs existing software and its AI-written replacement against one approved behavioral boundary.

EVALUATOR FIREWALL

The writer cannot grade its own rewrite.

Candidate generation stays separate from the reference, comparison policy, and evidence history.

Writer owns
Candidate code
Verifier owns
Truth boundary
Reviewer gets
Finding and evidence
PAIRED EXECUTION
  1. Verifier

    Pin the contract

    Approve the reference, inputs, runtime assumptions, observations, and comparison policy.

  2. Runner

    Execute the pair

    Run the existing system and candidate rewrite under the same declared conditions.

  3. Comparator

    Find the origin

    Stop at the earliest contract-relevant difference, before downstream effects obscure it.

  4. Evidence store

    Retain the evidence

    Return a replayable finding to the coding agent and a reviewable decision to the owner.

One changed decision. Two useful views.

Agent view isolates the next patch. Reviewer view translates the evidence into impact and a human decision.

This controlled example illustrates the intended loop; the paper states which arithmetic is reproducible and which historical execution artifacts are unavailable.

BEHAVIOR VERIFIER
COBOL TO JAVAIllustrative scenario B
AGENT DIAGNOSIS / F-02

First divergence: Branch action

Batch branch B-17 / null-account path

Cause isolated. Patch the changed branch and rerun.

REFERENCECOBOL
TRACE CAPTURED

IF ACCOUNT-ID = SPACES

NEXT SENTENCE

ELSE PERFORM WRITE-CLAIM

END-IF

CANDIDATEJAVA
TRACE CAPTURED

if (accountId == null) {

writeFallback(claim);

} else { writeClaim(claim); }

batch.advance();

EXECUTION CHECKPOINTS
  1. NULLAccount input
    NULLEQUIVALENT
  2. TRUEGuard B-17
    TRUEEQUIVALENT
  3. SKIP_WRITEBranch action
    WRITE_FALLBACKORIGIN
  4. 0Rows emitted
    1CHANGED
  5. UNCHANGEDBatch count
    INCREMENTEDCHANGED
FIRST DIVERGENCE

The first changed decision is Branch action: the source returns SKIP_WRITE while Java calls writeFallback.

Compilation can pass while behavior moves.

COBOL is the first executable reference. Fixed-width data and runtime assumptions make it an unforgiving test lane.

B-17 REPRESENTATION CHECK
COBOL / PIC X(8)Padded field
VIP·····

The literal is padded to the field width. The branch matches.

JAVA / STRINGUntrimmed value
VIP·····

The value is compared with a shorter string. The branch changes.

First changed assumption

Field width is behavior.

Reference
PRIORITY
Candidate
Branch skipped
What Strust fixes before the run
  • Capture source behavior as the approved reference
  • Compare only contract-relevant observations
  • Keep accepted cases for every later change
SEMAMIG-BENCH

Open evaluation protocol

A benchmark for behavior, not syntax.

SemaMig-Bench runs held-out workloads against the executable source and native Java candidate. Contract-relevant observations agree, or the task does not pass.

Read benchmark PDF
Task unit
Paired execution

COBOL reference and native Java candidate

Pass condition
Behavioral agreement

Declared observations match under the contract

Evidence
Reviewable finding

Per-task verdict, comparison output, and failure context

Bring the rewrite you cannot afford to get wrong.

Tell us what is changing and what behavior must stay the same.

Contact Strust