AI coding agents, held to evidence.

1 · It knows what your change actually touches, including the file you forgot

Before generating a line, CodeLead computes the change surface from the code itself: a symbol and dependency index, interface closures, and co-change obligations. If your change to a library must also land in a base class three projects away, that obligation is named up front, and a patch that skips it is refused, not merged.

Evidence. Asked for one aggregate method on a 17-year-old data-access library, CodeLead flagged a fourth file never mentioned in the request, a repository base class in another project, that a human reviewer had once missed. Retrieval benchmark: 0.97 mean core-recall, measured, re-scored after every change.

2 · Nothing reaches disk unchecked

Model output is treated as untrusted input. Every proposed patch passes deterministic gates (scope, path safety, plan compliance, syntax and convention sanity, repair effectiveness) before it can be applied, and every refusal is recorded with a written reason. The gate doesn't get tired on file four thousand, and it doesn't get charmed by confident output.

Evidence. 350+ benchmarked runs to date; zero unsafe applies, ever. During the original brownfield experiments a local model hallucinated file contents for fifteen rounds. Not one bad patch reached disk.

3 · Small increments, real commits: the way software has always been built

Humans hold a big picture and execute one small, completable thing at a time. CodeLead works the same way: it decomposes work into increments, each one built, validated, and committed on its own. You get a readable git history instead of a mega-diff, a resume point at every step, and failures that name the increment that caused them, with everything before it still green.

Evidence. Head-to-head on the same tasks and the same local model: the one-big-build approach produced 0 of 9 working apps; the incremental loop shipped working software as a sequence of verified commits, in roughly half the wall-clock.

4 · It runs on your machine, on models you choose

Local-first isn't a deployment option; it's the trust anchor. CodeLead runs against local open models by default, anything your hardware serves through LM Studio or Ollama, and treats remote models as an explicit, policy-gated escalation with a disclosure log. Governance is what makes small local models viable: decomposed, scoped, example-anchored tasks turn a model that's "occasionally right" into one that's boringly reliable. Swap in a frontier model and the governance gets more valuable, not less. The changes get bigger.

Evidence. The Pong game above was built by a 4B model, small enough to run on a phone, in about forty governed machine-minutes on consumer hardware. Nothing left the machine.

5 · Every change explains itself, forever

Each run closes into a structured evidence record: the request, what was retrieved, the surface, every gate verdict and refusal, validation results, approvals. Six months later you, or an auditor, can walk requirement to change to check to validation to approval without asking anyone. Paired with the project knowledge base, what CodeLead learns about your codebase (working commands, conventions, invariants, decisions) is kept with a trust level and a citation. A fourteen-times-verified build command and a chat rumor are visibly different kinds of knowledge, and only proven knowledge feeds future changes.

Evidence. The evidence chain is the same instrument this page is written from: every number here traces to a session log, a benchmark report, or a git history.