Found the real leak. A clean per-layer effect map, zero
fabrication, and it caught the smell review missed: a presentation-layer
Formatter reaching the database.
✓ candor-java · reads bytecode · knows Spring Data
candor · for the JVM · flagship engine
Your architecture,
enforced on every push.
Architecture erodes one reasonable-looking PR at a time. A formatter reaches the database “just this once.” A domain object grows a network call. Review misses it because the call is three hops away. candor makes the rule executable: the domain does no I/O; the web layer never touches the DB — proven in CI, every push.
No build step, no config — point it at a directory or jar of compiled classes:
jbang candor@tombaldwin/candor-java path/to/classes --policy arch.policy
01 It understands your framework
The thing that makes a gate useful on real apps, not toys: candor classifies a
Spring Data repository interface as Db even though there’s no user code to read
— the implementation is generated at runtime. The gate bites on the code you actually write.
1/386
Found the needle. Exactly one hidden network call in 386
functions — a DNS lookup inside an InetAddress adapter — with zero
false positives.
✓ candor-java · precision on real code
We run it on ourselves. candor-java analyses its own bytecode against its own policy every push, and cross-checks the static report against runtime-observed effects. The tool that guards your boundaries is guarded by itself.
✓ self-gate · spec §7, item 12 · + runtime oracle
02 Fast, and no special build
The JVM engine reads bytecode — point it at your compiled classes; no source instrumentation. Queries are instant lookups off a precomputed map: “what reaches the DB?”, “what does this PR introduce?” — no re-tracing. The gate runs in CI in seconds.
03 Adopt it
One command — candor-init — scaffolds the policy, the
baseline and the GitHub Action, and violations land inline on the PR diff and in the Security tab
(SARIF); five real-app case studies show the gate end-to-end.
The same effect spec runs as independent engines beyond the JVM
— Rust, TypeScript and Swift — checked by a shared conformance suite, so one policy file
works across your stack. Java is the deepest; the others are first-class, not afterthoughts.
Add the CI gate candor-spec v0.24
Disclosure, not a completeness proof: candor catches more than
review, and tells you where it’s unsure (an explicit Unknown) rather than guessing.
Work with the team behind candor
candor is built and run by Polymorphism — a small senior team that designs, builds and runs large systems for enterprise and government. The judgement we put into AI-code safety here is what we’d bring to your platform.