CheckYourself

For AI app builders, CheckYourself runs local challenges to test claimed work, record evidence, and expose risks. Score is not a guarantee.

Check yourself before you wreck yourself — for the apps you ship. Before you launch it, CheckYourself.

CheckYourself is a free, open-source, model-agnostic completion-evidence workflow for apps built with AI coding assistants. It turns any AI assistant — Cursor, Claude, ChatGPT, Gemini, Copilot, Windsurf, Replit, Lovable, Bolt, Codex, or a local agent — into a pre-launch reviewer that inspects your app, records observed and untested behavior, runs verifier-owned challenges, surfaces production gaps, proposes fixes for your approval, verifies local receipts, and writes a learning plan built from the exact gaps your own project had.

Under the hood it is a staged engineering system, not a single canned prompt: an ICM-style context workspace that routes the agent through each stage, an evidence-based 0–100 scoring method with severity caps, verifier-owned challenges across 20 canonical surfaces and 10 scored categories, a 19-capability production-hardening engine spanning auth, data, secrets, CI/CD, observability, privacy, and AI governance, JSON output schemas, report and risk templates, and a public validation suite. You install it as your AI assistant's operating context — no SaaS, no account, no lock-in to any one model.

The 2026-09-05 retrofit checkpoint is backed by 150 tests and 88 subtests, and python3 tools/validate_public.py . passes. These are repository checks, not a production-safety certification.

Table of contents

• What is CheckYourself?
• Why it exists
• Get started
• What it produces
• Verifier-owned challenge runner
• What it checks
• Works with every AI coding tool
• Who it is for
• How it works
• Optional local CLI
• Optional visual dashboard
• Token efficiency by design
• Safety model
• FAQ
• License

What is CheckYourself?

CheckYourself is an open-source reviewable completion-evidence system — a structured, staged engineering framework of context files, scoring logic, output schemas, templates, and production-hardening guidance. It records what was observed, what was inferred, what remains untested, and which risks still block launch; its verifier executes committed local challenges, rechecks stored executed receipts at score time, and validates report verdict consistency. It does not certify production safety or provide independent external custody of the evidence.

It answers one question that matters to every "vibe coder," indie hacker, and AI-assisted builder: "Is this app actually ready to ship, and if not, what exactly is wrong and how do I fix it?"

Unlike a "top three issues" linter, CheckYourself builds a complete findings register and a complete remediation backlog, produces a bounded 0–100 evidence score, and walks you through fixes one safe, reversible batch at a time. When the audit is done, it generates a bespoke learning plan so you actually learn from what your project was missing. The score remains scoped evidence, not a production-safety guarantee.

It is also organized as an ICM-style context workspace: CONTEXT.md routes the agent to staged folders, each major stage has its own CONTEXT.md, and durable handoff artifacts belong in stage output/ folders. CheckYourself is not affiliated with the RinDig ICM project; it uses the same file-first idea so agents know what to read, do, and produce at each step.

Why it exists

Apps built fast with AI tools tend to look finished long before they are safe to launch. The gaps are usually invisible from the happy path: missing auth checks, unvalidated inputs, leaked secrets, no backups, no rollback, no tests, no rate limits, no error tracking.

CheckYourself gives you reality before production does the grading — a calm, complete, plain-English second pass that any AI assistant can run on your behalf.

Get started

1. Download or clone this repository.
2. Put the checkyourself folder in or next to your project.
3. Point your AI coding assistant at the folder as its operating context. Start at CONTEXT.md — it routes the agent through each stage without loading the whole repo. New to the system? Read START_HERE.md first.
4. Run a read-only diagnostic and review the Production Reality Report.
5. Approve fixes one at a time or in safe, reversible batches.
6. Recheck and rescore after each batch.
7. Continue until every finding is fixed or proven not applicable; keep deferred, accepted-risk, and suppressed items visible as residual risk with owner and trigger context.
8. Get a custom learning plan based on the actual gaps.

No model lock-in. No required cloud account. No required command line.

Direct your assistant

Once the folder is in place, tell your AI assistant how to operate within it:

Use the checkyourself folder as your operating context.
Start with a read-only diagnostic.
Do not make code changes until I approve a specific fix.
Generate the dashboard only if I say `dashboard yes` or `dashboard inline`.
After the diagnostic, create a learning plan based on the gaps you found.

Visual workflow

Add the folder → run the audit → review the full backlog → approve fixes → verify → repeat → learn what you missed

CheckYourself is not a "top three issues" tool. It creates a complete findings register and a complete remediation backlog. The first approval batch is intentionally small so fixes stay safe, understandable, and reversible.

What it produces

Default outputs (see a real example in samples/sample-production-reality-report.md):

• Project Map — what your app appears to do.
• Detected Stack — framework, database, auth, hosting, tests, deployment signals, and confidence.
• Production Reality Score — a 0–100 score with caps and reasoning (how the score works).
• Coverage Sweep — every relevant production surface marked Pass, Finding, Unknown, or Not applicable.
• Complete Findings Register — every discovered risk, not just the obvious ones.
• Complete Remediation Backlog — every finding and blocking unknown in a deterministic severity, category, and finding-ID order.
• Highest-Severity Approval Batch — a small unresolved slice for review, not the whole scope. The local CLI does not infer safety, dependencies, coupling, or blast radius; the diagnostic and human approval gate still do.
• Guided Fix Loop — approve, fix, verify, rescore, repeat.
• Bespoke Learning Plan — what to learn next based on what your own app was missing.

Optional output:

• Human Audit Dashboard — one self-contained HTML/CSS dashboard that visualizes the score, risks, backlog, coverage, status, and learning plan. It is optional because dashboards use extra tokens. Ask for it with dashboard yes, or use dashboard inline for the compact Markdown fallback.

Verifier-owned challenge runner

The challenge verb executes the committed .checkyourself/challenges.json definitions against the project under review. The runner accepts argv-only commands, applies bounded timeouts, and treats a failed or timed-out challenge as a fail-closed finding. The verifier owns the execution receipt: a successful EXECUTED receipt is the only class eligible for full credit; caller-issued receipts remain explicitly UNVERIFIED and are capped.

At score time, stored executed receipts survive only a fresh verifier run that agrees on the exit state, success assertions, source and challenge bindings, and a semantic output digest. The digest normalizes volatile durations, timestamps, and paths while the raw capture hash still detects edits. Verifier-owned per-surface minimum contracts reject or cap semantic vacuity such as true, false, echo-only or print-only commands, hollow test-runner output, and trivial regexes.

The local integrity HMAC is project-local tamper evidence. It is not proof of independent issuance, operator identity, or external custody; externally controlled custody is future work. --claim records the accepted completion claim and labels evidence rows as claim-bound or unbound. Report validation labels schema validity separately from semantic verdict consistency and recomputes the verdict rather than trusting the supplied score.

The ASTRA adversarial review found eight findings and the retrofit closed them; the evidence trail is ASTRA-REVIEW.md and ASTRA-FIX-REPORT.md.

What it checks

The diagnostic sweeps the whole relevant production surface: