Launch week · 5 of 5

The contract
underneath it all

All week, one artifact did the quiet work — the thing a blind engineer reads to rebuild a unit without ever seeing the source. This is what it is, and why it is shaped the way it is.

Lane Thompson · 2026-07-10 · 7 min

In the essay that opened all this, four agents rebuilt the same function — three in JavaScript, one in Rust — and all four agreed on five thousand inputs. That only works if what they were handed contained the behavior without containing the code. A JavaScript source can't do that; it's JavaScript. What they were handed was a SIR — a Semantic Intermediate Representation — and it's the format underneath everything this week.

What a contract has to carry

A SIR describes one unit of behavior as a tree of kind-discriminated nodes: what it computes, what it branches on, what it depends on, what effects it performs across which boundaries. Load-bearing details are pinned exactly — a verbatim regex, an exact rounding rule, the order of a pipeline — because those are the accidents a re-implementer would otherwise guess wrong. Everything derivable is left derivable. The goal is a description precise enough that independent engineers converge, and no more code-like than that requires.

But the SIR text is deliberately not the source of truth. That's the load-bearing idea of the whole format:

The oracle is the substrate

A SIR artifact is self-contained: the spec plus a frozen, held-out oracle whose expected values were stamped by executing the original. The prose is an unverified prior — useful, optional, never load-bearing. Expected values are differential (run the original), never hand-authored. And a unit is only "verified" when N independent blind re-emissions agree on the full held-out set, with the original deleted. Prose can be wrong; the oracle can't be quietly moved.

Why language-neutral falls out for free

Because the contract pins behavior and the oracle grades behavior, nothing in it is tied to a language. A trigger — an HTTP route, a CLI command, a cron job — is metadata, not structure; the same body re-emits behind a different trigger. That's why a Next.js route and a Nest controller with the same choreography have the same SIR, and why a JavaScript function and a Rust one can be graded against the same vectors and proven identical. The source text is fungible. The executable behavior is fundamental. The whole week is downstream of that one sentence.

The format is versioned, evidence-cited, and open

SIR is at v0.4, and every addition since the v0.1 freeze cites the specimen that forced it — nothing is resolved from taste. KIND STATE earned its place when a vacuous differential let a do-nothing mutator score 200/200. Carried-data attestation earned its place when a reconstruction transcribed the wrong subset of a 660-entry table. Effect seams, fidelity variants, the concurrency layer — each has a name and a story. Changes are versioned, never silent; a shipped bundle records the spec version it targets, and the verifier checks it.

The normative spec lives at github.com/rederive/sir-spec — Apache-2.0, with a narrative introduction and worked examples. We would like nothing more than for the format to outgrow us: registry-native contracts, other implementations, a standard. The best outcome for a trust format is that it stops being ours.

That's the week

Five days, one idea from five sides. Vibe is uncertainty; remove the freedom and it disappears. Your tests agree with your code; an oracle constrains it instead. Run the original to modernize the code you fear. Source truth from properties and named leaves when there is no original. And underneath all of it, a contract that makes behavior portable and the oracle — not the author — the judge.

rederive is open source and live. Start here:

$ npm i -g rederive
$ rdv check <a verified package>      → deterministic, offline, no LLM
$ npx rederive audit                  # what your dependency tree really pulls in

Lane Thompson — Founder, rederive · GitHub · rederive.ai