Tenet
deterministicAI proposes. Tenet enforces. Never the other way round.

Agentswritethediff.Tenetdecideswhetheritbelongs.

Nobody reviews at agent speed. Architectural and business intent has to be machine-enforceable rather than living in prose an agent may or may not follow. Tenet makes intent a structured, versioned, human-approved object — then uses that same object to block the merge.

See a live verdictThe active tenets
analysing…live · recomputed per request
building the import graph…

—

current verdict

0

tenets enforced

0

modules

0

runtime dependencies

Not a screenshot and not a cache. This graph is rebuilt from the repository’s TypeScript source every time the page is requested — the same analyser the pull request check runs.

Gemini 3.5 Flash on Vertex AIGoogle GenAI SDKCloud RunModel Context Protocolts-morph static analysisGitHub ActionsPostgres + DrizzleNext.js 16Gemini 3.5 Flash on Vertex AIGoogle GenAI SDKCloud RunModel Context Protocolts-morph static analysisGitHub ActionsPostgres + DrizzleNext.js 16

two valid changes, one illegal result

main
holidayDiscount.percent = 20
src/pricing/discount-policy.ts:12
feat/premium-loyalty-discount
premiumLoyaltyDiscount.percent = 15
src/loyalty/premium-loyalty-discount.ts:3
git reports no conflict
combined customer discount—
20%
15%
cap 30%

measuring…

0%

combined discount the merge would have allowed

0%

the cap a human approved

0

textual conflicts git reported

0

tests behind the analyser

where it stops the work

GitHub says merge. Tenet says no.

The Action runs on every pull request and analyses the merged result, not the branch — the only way to catch two changes that are each correct alone. It posts the arithmetic with both source locations and fails a required check.

Watch the merge box: GitHub reports no conflicts with base branch in green at the same moment the required check goes red. Nothing else in the pipeline can see the problem.

No bot account, no webhook, no app to install — a workflow file in the governed repository and a second checkout of Tenet.

.github/workflows/tenet.yml
on: pull_request
run: tenet check --repo ../repo
gh pr comment --body-file …
OpenPremium loyalty discount at 15%#1

Arul6851wants to merge 1 commit intomainfromfeat/premium-loyalty-discount

Arul6851 commented

Adds a 15% discount for premium members. Individually within the 30% customer-discount cap. Compiles clean, no textual conflict with main.

Tenet is analysing refs/pull/1/merge…

Some checks haven't completed yet

1 expected check

Tenet / Verify declared intent (pull_request)ExpectedRequired

No conflicts with base branch

Merging can be performed automatically.

You can also merge this with the command line.

The Action checks the merged result, not the branch.

An agent that corrects itself.

Because the verdict is recomputed from source on every call and the evidence is structured rather than prose, the agent can close the loop on its own.

no human input between the first write and the final pass

  1. Agent writes

    imports raw-database-client directly

  2. tenet_verify

    BLOCK · checkout-service.ts:1:35

  3. Agent corrects

    routes through DatabaseGateway

  4. tenet_verify

    PASS · 0 violations

The agent takes the shortest path to working code. It compiles, and every test passes.

One object. Three places it does its job.

Supplied before the work

Active tenets reach the agent over MCP through tenet_list, and tenet sync writes them into the repository's CLAUDE.md and AGENTS.md. The constraint is in context before the first line is written.

MCP · stdio

Enforced inside the loop

tenet_verify recomputes the verdict from source on every call and hands back structured evidence — file, line, column, value. An agent can act on that without a person in the room.

tenet_verify

Enforced at the merge

The primary gate. The same object runs in CI against the merged result rather than the branch, posts the arithmetic as a pull request comment, and fails a required check so branch protection holds the merge.

GitHub Action
also, before you ever push

The same verdict, locally.

The pull request is where Tenet stops a merge, but nothing about it is special — it runs the identical analyser. The same check runs on a laptop or in a pre-commit hook and exits non-zero on a block.

npm run cli -- check --repo ../commerce-platform
tenet check — merged result

A model can propose. It can never decide.

Gemini turns a sentence into a structured draft and writes the explanation attached to a violation. It cannot activate a constraint, and it cannot move a verdict — the code that computes PASS or BLOCK imports no model client at all. The separation is structural, not a policy someone has to remember.

Watch a proposal get approved