Claims and evidence

Don't take our word for it.

Ratchet is sold on the idea that a claim about a side effect should be checkable rather than trusted. It would be strange to ask that of an agent and not of ourselves. So here is every claim this project makes about itself, the figure, and the link that settles it — including the ones we would rather not print.

Every row below is checked by somebody who is not us, or by a test that fails the build when the number and the claim disagree. Where neither is true, the row says so.

What we do not claim

This is the section most pages like this leave out, which is exactly why it is here. A list of achievements with no matching list of gaps tells you nothing, because you cannot tell what was omitted.

• There is no SOC 2 report. A gap analysis exists and controls are being written, but no auditor has been engaged and no observation window has started. Anyone who tells you a nine-day-old company is SOC 2 certified is describing a different company.
• There has been no penetration test and no third-party security audit.
• ISO/IEC 5230 and 18974 conformance is self-assessed and incomplete. One requirement is unmet in both — we have no retained legal counsel for licence questions — and conformance has deliberately not been submitted while that is true.
• The badges above are badges, not certifications. Best Practices is self-attested; its value is that every answer is public and you can call one wrong. Scorecard and REUSE are computed by others. None of the three is an audit.
• Exactly-once delivery is impossible and we never claim it. Ratchet guarantees at-most-once initiation, enforced by a database constraint, and makes the unknown case explicit instead of guessing. That is a different and smaller promise, and it is the honest one.

The same list, in more detail and kept current, is in KNOWN_LIMITATIONS.md.

How it was built, without the flattering edit

The first commit landed on 29 August 2026. The service was deployed, tested and documented, with the compliance work above already done, by 6 September. That is checkable rather than asserted: the commit history is public and timestamped, and no part of it was rewritten to look better.

Two things about it that a reader deserves without having to dig:

• It was built by one person with an AI pair. Every commit carries a Co-Authored-By line saying so. That is not a disclosure being made reluctantly here — it is in the history, on every commit, and always was.
• Most of it reached main without a second pair of human eyes. A second engineer has reviewed the code and a partner holds admin, but the review record is thin, and we count that against ourselves rather than rounding it up. It is why one OpenSSF criterion is still unmet. What review means here.

Speed is not the argument. A gate that decides whether real money moves earns trust from its failure modes, not its velocity — which is why the engineering notes are mostly about things that broke: a planned failover that left two primaries, a health check that was green through an outage, a bug that only appeared on macOS.

The claims police themselves

Numbers on a marketing page rot. Ours are wired to a test that fails the build when a published figure and the code disagree — claims-audit.test.ts checks that the coverage floors we advertise are the floors CI enforces, that the vendor count in our documents matches the vendor profiles that exist, and that the webhook events we publish are the events the code can actually emit.

It was written because we found four public figures that had quietly gone stale in a single afternoon. It has caught more since. That is the point of it: a claim nobody checks is a claim that is eventually wrong.

Who

Ratchet is a product of Deimos AI LLC, three people across Los Angeles, California and Baja California, Mexico. It is maintained by @thearchitect0x-glitch, with @mlimano5 as the second administrator. Governance, including what a successor would need, is written down in GOVERNANCE.md.

Found something on this page that is wrong? Open an issue — that is a better outcome for us than for it to stay up.