wreckit — Bulletproof AI Code Verification
Build it. Break it. Prove it works.
Philosophy
AI can't verify itself. Structure the pipeline so it can't silently agree with itself.
Separate Builder/Tester/Breaker roles across fresh contexts. Use independent oracles.
Full 14-step framework: references/verification-framework.md
Modes
Auto-detected from context:
| Mode |
Trigger |
Description |
| 🟢 BUILD |
Empty repo + PRD |
Full pipeline for greenfield |
| 🟡 REBUILD |
Existing code + migration spec |
BUILD + behavior capture + replay |
| 🔴 FIX |
Existing code + bug report |
Fix, verify, check regressions |
| 🔵 AUDIT |
Existing code, no changes |
Verify and report only |
Gates
Read the gate file before executing it. Each contains: question, checks, pass/fail criteria.
| Gate |
BUILD |
REBUILD |
FIX |
AUDIT |
File |
| AI Slop Scan |
✅ |
✅ |
✅ |
✅ |
references/gates/slop-scan.md |
| Type Check |
✅ |
✅ |
✅ |
✅ |
references/gates/type-check.md |
| Ralph Loop |
✅ |
✅ |
✅ |
❌ |
references/gates/ralph-loop.md |
| Test Quality |
✅ |
✅ |
✅ |
✅ |
references/gates/test-quality.md |
| Mutation Kill |
✅ |
✅ |
✅ |
✅ |
references/gates/mutation-kill.md |
| Cross-Verify |
✅ |
❌ |
❌ |
❌ |
references/gates/cross-verify.md |
| Behavior Capture |
❌ |
✅ |
❌ |
❌ |
references/gates/behavior-capture.md |
| Regression |
❌ |
✅ |
✅ |
❌ |
references/gates/regression.md |
| SAST |
❌ |
❌ |
✅ |
✅ |
references/gates/sast.md |
| LLM-as-Judge |
opt |
opt |
opt |
opt |
references/gates/llm-judge.md |
| Design Review |
❌ |
❌ |
❌ |
✅ |
references/gates/design-review.md |
| CI Integration |
✅ |
✅ |
❌ |
✅ |
references/gates/ci-integration.md |
| Proof Bundle |
✅ |
✅ |
✅ |
✅ |
references/gates/proof-bundle.md |
Scripts
Deterministic helpers — run these, don't rewrite them:
scripts/detect-stack.sh [path] — auto-detect language, framework, test runner → JSONscripts/check-deps.sh [path] — verify all dependencies exist in registriesscripts/slop-scan.sh [path] — scan for placeholders, template artifacts, dead codescripts/mutation-test.sh [path] [test-cmd] — automated mutation testing (up to 20 mutations)scripts/mutation-test-stryker.sh [path] — Stryker-based mutation testing → JSONscripts/coverage-stats.sh [path] — extract raw coverage numbers from test runnerscripts/design-review.sh [path] — dep graph, coupling, circular dep detection → JSONscripts/ci-integration.sh [path] — CI config detection and scoring → JSON
Swarm Architecture
For multi-gate parallel execution, read references/swarm/orchestrator.md.
Quick overview:
Main agent → wreckit orchestrator (depth 1)
├─ Planning: Architect worker
├─ Building: Sequential Implementer workers
├─ Verification: Parallel gate workers
├─ Sequential: Cross-verify / regression / judge
└─ Decision: Proof bundle → Ship / Caution / Blocked
Critical: Read references/swarm/collect.md before spawning workers.
Never fabricate results. Wait for all workers to report back.
Worker output format: references/swarm/handoff.md.
Config required:
{ "agents.defaults.subagents": { "maxSpawnDepth": 2, "maxChildrenPerAgent": 8 } }
Decision Framework
| Verdict |
Criteria |
| Ship ✅ |
All gates pass, ≥95% mutation kill, zero slop |
| Caution ⚠️ |
All pass but mutation kill 90-95%, or minor slop in non-critical |
| Blocked 🚫 |
Any gate fails, hallucinated deps, <90% mutation kill |
Running an Audit (Single-Agent, No Swarm)
For small projects or when swarm isn't needed, run gates sequentially:
scripts/detect-stack.sh → know your target (language, test cmd, type checker)scripts/check-deps.sh → verify deps are real (not hallucinated)scripts/slop-scan.sh → find placeholders, template artifacts, empty stubs- Run type checker (from detect-stack output) →
references/gates/type-check.md
- Run tests +
scripts/coverage-stats.sh → references/gates/test-quality.md
scripts/mutation-test.sh → references/gates/mutation-kill.md (uses mutmut/cargo-mutants/Stryker if available)scripts/red-team.sh → references/gates/sast.md (20+ vulnerability patterns, JSON report)scripts/design-review.sh → references/gates/design-review.md (dep graph, circular deps, god modules)scripts/ci-integration.sh → references/gates/ci-integration.md (CI config detection + scoring)scripts/dynamic-analysis.sh → references/gates/dynamic-analysis.md (memory leaks, race conditions)scripts/perf-benchmark.sh → references/gates/performance.md (benchmark detection + regression)scripts/property-test.sh → references/gates/property-based.md (fuzzing, invariant checks)scripts/differential-test.sh → references/gates/differential.md (oracle comparison, metamorphic tests)- Read + execute
references/gates/proof-bundle.md → write .wreckit/
Quick Start
"Use wreckit to audit [project]. Don't change anything."
"Use wreckit to build [project] from this PRD."
"Use wreckit to fix [bug]. Prove nothing else breaks."
"Use wreckit to rebuild [project] in [framework]."
Dashboard
assets/dashboard/ contains a local web dashboard for viewing proof bundles across repos.
Run: node assets/dashboard/server.mjs (port 3939). Reads .wreckit/dashboard.json from projects.
1---2name: wreckit3description: Bulletproof AI code verification. The agent IS the engine — no external tools required. Spawns parallel verification workers that slop-scan, type-check, mutation-test, and cross-verify before shipping. Language-agnostic. Framework-agnostic. Use when: (1) Building new projects and need verified, tested code ("build X with tests"), (2) Migrating/rebuilding codebases ("rewrite in TypeScript"), (3) Fixing bugs with proof nothing else broke ("fix this bug, verify no regressions"), (4) Auditing existing code quality ("audit this project", "how good are these tests?"), (5) Any request mentioning "wreckit", "mutation testing", "verification", "proof bundle", "code audit", or "bulletproof". Produces a proof bundle (.wreckit/) with gate results and Ship/Caution/Blocked verdict.4---56# wreckit — Bulletproof AI Code Verification78Build it. Break it. Prove it works.910## Philosophy1112AI can't verify itself. Structure the pipeline so it can't silently agree with itself.13Separate Builder/Tester/Breaker roles across fresh contexts. Use independent oracles.1415> **Full 14-step framework:** `references/verification-framework.md`1617## Modes1819Auto-detected from context:2021| Mode | Trigger | Description |22|------|---------|-------------|23| 🟢 BUILD | Empty repo + PRD | Full pipeline for greenfield |24| 🟡 REBUILD | Existing code + migration spec | BUILD + behavior capture + replay |25| 🔴 FIX | Existing code + bug report | Fix, verify, check regressions |26| 🔵 AUDIT | Existing code, no changes | Verify and report only |2728## Gates2930Read the gate file before executing it. Each contains: question, checks, pass/fail criteria.3132| Gate | BUILD | REBUILD | FIX | AUDIT | File |33|------|-------|---------|-----|-------|------|34| AI Slop Scan | ✅ | ✅ | ✅ | ✅ | `references/gates/slop-scan.md` |35| Type Check | ✅ | ✅ | ✅ | ✅ | `references/gates/type-check.md` |36| Ralph Loop | ✅ | ✅ | ✅ | ❌ | `references/gates/ralph-loop.md` |37| Test Quality | ✅ | ✅ | ✅ | ✅ | `references/gates/test-quality.md` |38| Mutation Kill | ✅ | ✅ | ✅ | ✅ | `references/gates/mutation-kill.md` |39| Cross-Verify | ✅ | ❌ | ❌ | ❌ | `references/gates/cross-verify.md` |40| Behavior Capture | ❌ | ✅ | ❌ | ❌ | `references/gates/behavior-capture.md` |41| Regression | ❌ | ✅ | ✅ | ❌ | `references/gates/regression.md` |42| SAST | ❌ | ❌ | ✅ | ✅ | `references/gates/sast.md` |43| LLM-as-Judge | opt | opt | opt | opt | `references/gates/llm-judge.md` |44| Design Review | ❌ | ❌ | ❌ | ✅ | `references/gates/design-review.md` |45| CI Integration | ✅ | ✅ | ❌ | ✅ | `references/gates/ci-integration.md` |46| Proof Bundle | ✅ | ✅ | ✅ | ✅ | `references/gates/proof-bundle.md` |4748## Scripts4950Deterministic helpers — run these, don't rewrite them:5152- `scripts/detect-stack.sh [path]` — auto-detect language, framework, test runner → JSON53- `scripts/check-deps.sh [path]` — verify all dependencies exist in registries54- `scripts/slop-scan.sh [path]` — scan for placeholders, template artifacts, dead code55- `scripts/mutation-test.sh [path] [test-cmd]` — automated mutation testing (up to 20 mutations)56- `scripts/mutation-test-stryker.sh [path]` — Stryker-based mutation testing → JSON57- `scripts/coverage-stats.sh [path]` — extract raw coverage numbers from test runner58- `scripts/design-review.sh [path]` — dep graph, coupling, circular dep detection → JSON59- `scripts/ci-integration.sh [path]` — CI config detection and scoring → JSON6061## Swarm Architecture6263For multi-gate parallel execution, read `references/swarm/orchestrator.md`.6465**Quick overview:**66```67Main agent → wreckit orchestrator (depth 1)68 ├─ Planning: Architect worker69 ├─ Building: Sequential Implementer workers70 ├─ Verification: Parallel gate workers71 ├─ Sequential: Cross-verify / regression / judge72 └─ Decision: Proof bundle → Ship / Caution / Blocked73```7475**Critical:** Read `references/swarm/collect.md` before spawning workers.76Never fabricate results. Wait for all workers to report back.77Worker output format: `references/swarm/handoff.md`.7879**Config required:**80```json81{ "agents.defaults.subagents": { "maxSpawnDepth": 2, "maxChildrenPerAgent": 8 } }82```8384## Decision Framework8586| Verdict | Criteria |87|---------|----------|88| **Ship** ✅ | All gates pass, ≥95% mutation kill, zero slop |89| **Caution** ⚠️ | All pass but mutation kill 90-95%, or minor slop in non-critical |90| **Blocked** 🚫 | Any gate fails, hallucinated deps, <90% mutation kill |9192## Running an Audit (Single-Agent, No Swarm)9394For small projects or when swarm isn't needed, run gates sequentially:95961. `scripts/detect-stack.sh` → know your target (language, test cmd, type checker)972. `scripts/check-deps.sh` → verify deps are real (not hallucinated)983. `scripts/slop-scan.sh` → find placeholders, template artifacts, empty stubs994. Run type checker (from detect-stack output) → `references/gates/type-check.md`1005. Run tests + `scripts/coverage-stats.sh` → `references/gates/test-quality.md`1016. `scripts/mutation-test.sh` → `references/gates/mutation-kill.md` (uses mutmut/cargo-mutants/Stryker if available)1027. `scripts/red-team.sh` → `references/gates/sast.md` (20+ vulnerability patterns, JSON report)1038. `scripts/design-review.sh` → `references/gates/design-review.md` (dep graph, circular deps, god modules)1049. `scripts/ci-integration.sh` → `references/gates/ci-integration.md` (CI config detection + scoring)10510. `scripts/dynamic-analysis.sh` → `references/gates/dynamic-analysis.md` (memory leaks, race conditions)10611. `scripts/perf-benchmark.sh` → `references/gates/performance.md` (benchmark detection + regression)10712. `scripts/property-test.sh` → `references/gates/property-based.md` (fuzzing, invariant checks)10813. `scripts/differential-test.sh` → `references/gates/differential.md` (oracle comparison, metamorphic tests)10914. Read + execute `references/gates/proof-bundle.md` → write `.wreckit/`110111## Quick Start112113```114"Use wreckit to audit [project]. Don't change anything."115"Use wreckit to build [project] from this PRD."116"Use wreckit to fix [bug]. Prove nothing else breaks."117"Use wreckit to rebuild [project] in [framework]."118```119120## Dashboard121122`assets/dashboard/` contains a local web dashboard for viewing proof bundles across repos.123Run: `node assets/dashboard/server.mjs` (port 3939). Reads `.wreckit/dashboard.json` from projects.
johnalbertini14-glitch