Wiregent

A founder points Wiregent at a repository, uploads an archive, or connects a vibe-coding platform. The source lands in custody, not in an investor inbox. A sandboxed runner clones it, measures it deterministically, probes whether the deployed thing answers, and emits a signed attestation — a certificate sealing what was measured, chained to the previous one so a missing certificate is provable rather than merely absent. The investor gets the certificate and the verdict. They never get the code.

The verdict itself is graded against a taxonomy of eleven diligence categories with four weight profiles, and it is deliberately honest about its own reach: the engine can compute a few of those categories today and says plainly that it cannot score the rest. A pre-revenue company with no growth metric is reported as unproven rather than failed — the distinction between "there is no API" and "the API is not growing" is two different sentences about two different companies, and collapsing them was rejecting exactly the founders the product exists to find.

• Sealed evaluation. The investor receives a verdict instead of the source — not because the code is precious, but because a verdict a counterparty can trust should not require disclosure, and neutrality requires a third party holding the middle.
• Evidence with provenance. Every claim carries a rung: self-declared, platform-verified, third-party-verified. A verdict that cannot cite anything says so.
• Signed, chained certificates. Canonical-JSON attestations with a public verification endpoint and a public key, so a third party can check a certificate without asking Wiregent to vouch for it.
• A two-sided negotiation harness. Founder and investor agents haggle under a per-run token budget, a prompt firewall, and metered spend, with the full transcript kept as part of the record.
• Autonomy stops at the mandate line. Above a scout’s auto-invest threshold, clearing pauses for a human authorisation window; a timeout fails the deal rather than forcing it through.

Between 20 and 27 July 2026 the project went from a scaffold to a working platform: 195 commits, 348 files touched, and roughly 145,000 lines added. Source files went from 101 to 222 and test files from 17 to 47 — the tests grew faster than the code they cover, which is the only reason velocity at that rate is worth anything.

• Double-entry ledger. A sole-writer module posts balanced transactions; unbalanced or empty leg sets throw and nothing is appended.
• Hash chain per account. Each entry seals its canonical fields plus the current chain tip for its own account, so tampering with one account’s history is detectable without re-reading every other account.
• Integer money. Every amount is cents as an integer, with an explicit safe-range assertion — never a float dollar.
• Derived balances. Balances are recomputed from the legs on read. That is the whole point of a ledger: the number is never something you have to trust someone to have updated.

The repository ships a second ledger that has nothing to do with money: a row-by-row inventory grading every capability as real, simulated-but-contract-stable, demo theatre, or absent-and-reported-as-absent. That last category exists on the argument that some things — a measurement, a signature, an identity — are worth more as a stated gap than as a plausible number. A companion reality map draws the same architecture with every component marked, and the standing rule is that where the map and the code disagree, the code is right and the map is a bug.

The same discipline runs through the product itself: declared protocols carry version numbers where a 0.x states the standard is declared and a 1.x states it is enforced, so a page can name a standard without implying it is binding. One of the project’s own commit messages reads: “the live site was overselling what it cannot do and hiding what it can.”

For six days after the 2026-08-10 pass, the honesty ledger was entirely about what the platform admitted it could not check — every diligence category graded no higher than self-declared. On 2026-08-16 that changed once: a UK company-registry lookup landed as the platform's first verification producer, and it is the first piece of evidence in the system that a founder did not write themselves.

The design stays deliberately narrow. A producer returns a check_id — never a grade, a source, or even a channel; the channel remains a static property of a frozen catalog, and one module stays the only place a grade gets produced from anything. The same standing rule that governs everything else in the system applies here without exception: credit follows evidence, not assertion, and an unbacked claim earns nothing.

• One category moved, on purpose. Of eleven diligence categories, exactly one — the UK registry check — now grades above self-declared. The other ten still say so honestly.
• Producibility is scoped to the pitch, not the jurisdiction. A producer that could not have run for a given company never changes that company's numbers — enforced at every layer the evidence passes through, not only at the point it is produced.
• A confidentiality wall proven, not assumed. Forty-one sentinel values are planted across the system and every founder-reachable endpoint is walked and scanned whole, in a single pass — never field by field, never endpoint by endpoint. Nothing crosses the boundary, and the same scan runs continuously to keep it that way.

The public site is Cloudflare Workers static assets behind a front-door Worker; the engine is a single Fly.io machine in London that never sleeps because it holds the SSE stream; artifacts live in Cloudflare R2. Fly bills for the machine existing rather than for cycles consumed, so deals, negotiations and event fan-out all run inside the same fixed envelope at the same price as an idle box — roughly six dollars a month, all in.

The model layer is vendor-agnostic by construction: three drivers behind one interface, with a deterministic driver that needs no key, no model and no network as the default. Any model failure, timeout or malformed response falls back to it rather than erroring the request, which is why the whole platform still works — and costs nothing per run — with no API key set at all.

I bring high-leverage product engineering and absolute operational discipline: shipping weekly, pressure-testing user inputs, and automating delivery pipelines.

Ask how this applies to you →