DACIP DACIP PROOF
WEEKLY · PUBLIC · FALSIFIABLE

Run it again.
Get the same bytes.

"Deterministic" is easy to say and easy to fake. So this page re-scans every audited open-source repo at its pinned commit — and runs every scan twice. If the two runs are not byte-for-byte identical, the row below turns red where everyone can see it.

Same pinned commit, same engine version, anyone's machine: uvx dacip investigate reproduces these numbers. No LLM reviewer can put up a page like this, because no LLM gives the same answer twice.

last run: … engine: … objective: …
–
scans byte-identical on the second run, tonight
–
major OSS repos, pinned commits, scanned cold
–
backend routes extracted from source
–
frontend API calls matched against them
–
defect-grade findings asserted across all 14, each with evidence

Every run, repo by repo.

Each repo is fetched at its pinned commit and analyzed twice from a clean slate. The hash covers every artifact the run produces: findings, coverage, diagnostics, the report, the repros. Nine are cross-stack Python and TypeScript; five are TypeScript-only — Next.js App Router, Server Actions and Prisma, with no Python in the repository at all.

RepositoryPinned commitFilesRoutesCallsBackend seenDefectsRerun checkScan time
loading data.json …

Defect counts are what the evidence gate asserts at these exact commits — three of the historical findings are linked below as receipts; fixed ones no longer derive, which is the point. Read the defect count together with “backend seen”. A defect is only asserted where route extraction is trustworthy enough to license one, so a low match rate means DACIP did not extract the server this frontend talks to — its silence there is a statement about our coverage, not about the repository. A dash means nothing was comparable (backend-only repositories).

The receipts behind the zero-FP claim.

Every asserted defect from the original audit was hand-verified and disclosed upstream, under this project's name, where the maintainers could call us wrong.

Method — reproduce it yourself

# any repo below, at its pinned commit
git fetch --depth 1 origin <pinned-sha> && git checkout FETCH_HEAD
uvx dacip investigate "api contract audit"
# run it again — same store wiped, same commit
uvx dacip investigate "api contract audit"
# diff the artifacts: they are the same bytes
diff -r run1/.dacip/runs run2/.dacip/runs   # → empty

The scheduled job does exactly this — tools/proofrun.py — and publishes the raw output as data.json.

What this proves — and what it doesn't

Proves: the engine is deterministic in public — same commit in, byte-identical verdict out, re-checked every week on 14 production-scale codebases.
Proves: the extraction numbers are live, not marketing: routes, calls, and findings regenerate weekly from source you can check out.
Doesn't prove: zero false positives by itself — that claim rests on the hand-verified, upstream-disclosed findings above, and it stays falsifiable: dispute any asserted defect and we'll correct it in public.
Doesn't prove: completeness. Dynamic routes and unsupported frameworks are counted and labelled in every run — DACIP tells you what it can't see instead of guessing.