Delivery and evaluation

TrueVectors is delivered CI-first for authorized enterprise evaluations. The Auditor runs against the checked-out workspace in your pipeline or in a container inside your environment. Your artifacts stay there; only a metrics-only receipt (counts, hashes, verdict tiers — never source, paths, or prose) can reach the TrueVectors Hub.

Public distribution is closed

There is no public installer, GitHub Action, container image, or self-serve account flow today. Enterprise delivery is arranged directly when an evaluation is authorized. The desktop app is an optional evaluation surface, not the enterprise delivery path, and no installer is currently published.

1. Request an authorized evaluation

Email [email protected] with your name, company, target repositories or artifacts, CI platform, and what you need to prove. Public visitors who do not need product access can use the audit record and its standalone reproduction bundles to inspect the method with no TrueVectors software or account.

2. Receive the authorized CI delivery

For an approved evaluation, TrueVectors provides the private, versioned pipeline or container reference and deployment instructions directly. Public GitHub Action and container references are intentionally not documented until an authorized release exists.

• Add the supplied step to the existing CI workflow.
• Run it against the checked-out workspace; source and artifacts remain in your environment.
• Start with the deterministic proof tier, which uses zero model tokens and needs no API key.
• Enable optional model-assisted checks only under the agreed provider and network boundary.

The CI/VPC boundary is documented separately; it is not a download page and contains no public artifact references. See delivery model →

3. Run and review an audit

Point the authorized CI job at the work you want to hold to account:

1. Pick a target — a local folder, a GitHub repo, or a PR diff.
2. Run the audit. The engine runs in your CI workspace or VPC; your code and artifacts never leave that environment.
3. Read the receipt. Findings are stamped with their evidence tier (deterministic, corroborated, refuted, counterexample, property_checked, or bare llm), with the proved tier shown first.

The deterministic proof tier runs with zero tokens and no API key. The optional LLM tier uses the provider authorized for the evaluation — you trigger it explicitly, and only those LLM calls cross the execution boundary.

When a run finishes, a metrics-only receipt is pushed to the Hub so your fleet history and trends stay current. Source code, file paths, finding prose, and prompts are never uploaded.

Where the audit actually runs

TrueVectors keeps three surfaces separate, and only the auditor ever runs an audit:

Surface	Host	What it does
Marketing	www.truevectors.ai	This site. No code, no audits.
Control plane (Hub)	app.truevectors.ai	Authorized account, team, and fleet history. Receives the metrics-only receipt; never runs an audit.
Auditor	your CI / VPC	The engine that does the work. It runs in the checked-out workspace or an authorized container — your artifacts stay in your environment.

Regulated buyers can run the sealed engine entirely inside their own VPC, with LLM calls kept on the AWS network via a Bedrock PrivateLink endpoint.

Prove outcome invariants (no API key)

Beyond auditing code, the Auditor can prove that a realized artifact obeys the rules it must hold — checked with math, zero LLM tokens.

Zero-config. Point the Auditor at a repo or folder and it discovers the output your code produced (any .csv / .json / .parquet it emits) and pairs it with the code behind it — no file naming, no setup. If several outputs look plausible, it asks which to audit rather than guessing. It also mines candidate rules mechanically from the data itself — unique keys, functional dependencies — with zero model tokens, alongside the AI-proposed rules; every rule, whatever proposed it, is proved or refuted by the deterministic checker.

Demonstrated, not just described. Run cold against 13 public dataset repos — no configuration, no rules, no hints — this pipeline audited 12, rendered every verdict deterministically over the full artifacts, and surfaced a real duplicated-record anomaly in the U.S. federal budget dataset shipped with a major visualization library (verified by hand). On the flagship budget-overrun case it derives the rules itself and proves the $9,050,040-vs-$500,000 breach with zero human hints — the fan-out root cause is caught by the mechanical miner alone, no LLM involved. Rules derived by the AI are always labeled hypotheses: the proof is the checker's, the proposal is not.

Then hold that output to account with a small set of rules, each of a domain-agnostic kind (bound, conservation, cardinality, monotonicity, distribution). Either declare them yourself in .truevectors/invariants.yaml for a no-key, zero-token deterministic check:

schema_version: 1
invariants:
  - id: spend-within-budget
    kind: bound
    statement: "Total weekly spend never exceeds the $500k cap."
    column: spend_usd
    agg: sum
    op: "<="
    value: 500000
    group_by: [week]
  - id: parts-sum-to-total
    kind: conservation
    statement: "Line items sum to the invoice total."
    parts: [subtotal, tax]
    whole: total

…or let the Auditor propose the invariants for you from the discovered output and dispose them deterministically — the math still has the last word. Declared .truevectors/ files always take precedence, and an optional .truevectors/artifact.yaml can pin a specific output. Each violated rule names the offending rows/steps in the receipt. Because the deterministic proof path needs no key, it is the lowest-friction evaluation path once access is authorized.

Delivery surfaces

The same engine can drive several surfaces. These describe the product architecture, not public downloads:

• CI / private container — recommended for enterprise. Authorized delivery runs one versioned engine in the existing pipeline or VPC.
• CLI. The JSON summary leads with proved-tier findings; --all reveals the llm tier. It is dry-run by default.
• VS Code / Cursor extension. An optional evaluation surface that drives the same engine from the IDE.
• Desktop. Optional for individual evaluation; no public installer is currently published.
• GitHub integration. The engine can post proved-tier-first PR results and enforce an authorized required-check configuration, but there is no public GitHub Action reference today.

Verification profiles

Profiles bundle the verification stages so most users never touch individual flags:

profile	what it turns on
fast	LLM + deterministic detectors only (cheapest, default-equivalent).
standard	adds the tool-runner oracles (e.g. ruff).
deep-verify	adds the sandboxed counterexample / data-contract stages — still requires the per-repo allowlist; profiles never bypass the two-key gate.

Private by default

TrueVectors is environment-local and uses zero product telemetry: no usage ping, analytics, or phone-home. Your work, findings, file paths, and prompts stay in the authorized CI/VPC boundary except for explicitly enabled LLM calls; the control plane only stores the aggregate, metrics-only receipt.

Request access

Email [email protected] with your name, company, CI platform, and the codebase or artifact you want to evaluate. Access and delivery instructions are provided directly when authorized.