Did the change stay within the boundary?
Check changed paths against the planned scope and surface unexpected repository mutations instead of silently treating them as part of the plan.
Open source · local-first · AI coding-agent verification
AI changes code.
Vericore verifies it.
Vericore creates a repository-bound change contract before an AI coding agent edits code, then verifies the actual repository state against that original boundary.
PREPARE
change: add payment validation
contract: agent-change-contract.json
planned path: PaymentService.kt
AGENT CHANGES CODE
PaymentService.kt ✓
PaymentValidator.kt ✓
PaymentDatabase.kt ← unexpected
VERIFY
scope check ✗ FAIL
unexpected mutation 1 file
The original contract stays authoritative.WHAT IT VERIFIES
Verify AI coding-agent changes against the plan—not a moving target.
VeriCore is an open-source verification layer for AI-assisted software development. Before an agent edits a repository, VeriCore records a persisted Agent Change Contract that describes the intended change boundary. After the agent finishes, VeriCore checks the resulting repository against that original contract and the evidence available to it.
Is the evidence tied to the intended repository state?
VeriCore uses repository identity, state fingerprints, and contract integrity checks to help detect stale or altered verification context.
What was actually verified?
Verification results distinguish passing and failing checks from inconclusive or unevaluated criteria. The result is designed to be inspectable, not a vague “AI says it looks good.”
HOW IT WORKS
Prepare → Change → Verify
The contract is created before implementation and remains the reference point after the code changes.
- 1
Prepare the change
Analyze the repository and save a contract describing the expected scope and verification criteria.
- 2
Let your coding agent work
Use your normal AI coding workflow. VeriCore is a verification layer; it does not need to take over the agent or autonomously rewrite your source files.
- 3
Verify against the original contract
Evaluate the changed repository against the saved boundary and available evidence, then inspect the verification result and receipt.
Important: VeriCore does not claim to prove that code is bug-free or semantically correct. It checks declared constraints against the evidence its current evaluators can assess; unsupported criteria may remain inconclusive or unevaluated.
WHO IT IS FOR
For teams that need evidence after AI writes code.
VeriCore is especially relevant when AI coding agents are changing real repositories and developers need a clearer record of what was allowed, what changed, and what checks actually passed.
Developers using AI coding agents
Catch out-of-scope file changes and review whether an agent's work matches the intended change boundary.
Maintainers and engineering teams
Add a repeatable, evidence-first check to code review and change workflows, particularly in Java and Kotlin repositories.
Agent and tooling builders
Explore CLI, local MCP, REST, and GitHub Actions integration points for repository-aware verification workflows.
THE VERICORE LOOP
From repository evidence to a verified change.
Vericore keeps engineering reasoning grounded in the state of the repository instead of treating AI output as the source of truth.
Prepare
Create the verification boundary
Build deterministic repository evidence and persist the intended change boundary before implementation.
See the evidenceChange
Let the developer or agent implement
Use the prepared plan and contract as the boundary for the normal coding workflow or AI coding agent.
See the workflowVerify
Verify the original contract
Detect unexpected paths, stale state, contract tampering, and other verification failures without regenerating the boundary.
See the proof01 / WHAT SHIPS
More than code analysis.
Vericore connects deterministic repository evidence to engineering decisions, architecture checks, impact analysis, and—most importantly—the verification boundary around AI-assisted changes.
Repository Intelligence
Java/Kotlin discovery, parsing, configurable exclusions, parallel analysis, caching, and self-contained HTML reporting.
Dependency & Graph IntelligenceDependency graphs, wildcard imports, cycles, connected components, PageRank knowledge hotspots, and learning paths.
Git & EvolutionAuthorship, churn, modification time, recent changes, time-based commit sampling, and source-history hotspots.
Change & PR IntelligenceDependency-aware impact, blast-radius signals, change-size/risk signals, architecture findings, tests, and machine-readable artifacts.
Architecture GovernanceArchitecture findings, drift against an explicit baseline, deterministic contracts, severity/finding/cycle limits, and decision records.
Engineering Context & RealityVersioned snapshots, repository fingerprints, Git HEAD binding, context diffs, and deterministic Reality identity.
Grounded Repository Q&AIntent-aware retrieval, bounded evidence, deterministic ranking, citations, and explicit insufficient-evidence handling.
Engineering PlannerRead-only, evidence-backed implementation plans with affected components, risks, steps, verification criteria, and uncertainty.
Agent Change ContractA persisted repository-bound change boundary with planned paths, evidence, verification, architecture expectations, and SHA-256 fingerprint.
Prepare → Change → VerifyPrepare before implementation and verify the original persisted contract after the change; tampering and stale state are detectable.
CLI · REST · MCPThe same intelligence is available through the CLI, local Ktor REST API, and local MCP stdio integration.
Optional AIGemini/Anthropic assistance can reason over bounded repository-derived context; AI is disabled unless explicitly configured.
02 / TRUST MODEL
Deterministic evidence first. Reasoning second.
Repository facts, Git history, and architecture signal are treated as the source of truth. AI is optional and bounded, never the authority that decides what is true.
Source, history, and state
Vericore captures the repository as it exists, including structure, dependency relationships, churn, and Git context.
Deterministic facts
It builds architecture findings, impact signals, hotspots, evolution clues, and evidence-backed summaries.
Prepare and verify
Before code changes, a persisted contract captures the expected boundary. After changes, it verifies the original state against the updated repository.
03 / PROOF
From repository facts to a bounded engineering change.
Follow the loop from repository structure to change impact, evidence, plan, safety boundary, and final verification.
Repository map
Map the source graph, dependency edges, and impacted modules before drawing conclusions.
Impact
See the blast radius and the components most likely to be affected by a change.
Evidence
Ground reasoning in citations, architecture links, and repository-derived facts rather than assumptions.
Verification
Confirm the code still matches the prepared contract, not just a regenerated plan.
04 / LOCAL-FIRST
Run it where your code already lives.
Released archives bundle the Java runtime and local tooling needed for repository intelligence, architecture checks, safety contracts, and verification workflows.
Local analysis
Keep the source of truth on disk, local to the repository, with deterministic artifacts and explicit boundaries.
Trusted by default
Vericore is designed around explicit repository validation, not silent reasoning or platform-side assumptions.
Ready for engineering teams
Use it for architecture review, dependency understanding, risk assessment, Q&A, and safe change planning.
OPEN SOURCE
Inspect the implementation.
Read the implementation, contracts, architecture docs, design notes, and verification workflows in the canonical Vericore repository.