A whole backend, one Bend program, one binary.
An AI app builder wrote a backend framework as a single Bend program: HTTP, auth, rate limits, a write-ahead log, REST and MCP, compiled through C into one native binary with no database, no proxy and no queue beside it. It shipped with a verification discipline worth stealing. This page is the framework and that discipline; bochtCMS is the app built on top, and the curve its tests missed.
Bocht is a backend framework written as one Bend program. Bend compiles it to C, clang compiles that to a single native binary, and that binary is the whole service: no database process, no reverse proxy, no queue. Everything a request touches lives in the same address space.
POST /mcp for the CMS.I didn't write Bocht. I directed an AI app builder that wrote it, and it worked under a verification discipline worth stealing: no claim ships unless it can be re-derived from files on disk.
Each one ends with one canonical line: RESULT: PASS=n FAIL=0. No line, no claim.
A stamp script writes the exact binary's SHA-256 next to every result file it produced.
Source hash, binary hash, build exit code and manifest must all agree before "done" is written.
A read-only backup and a hash sidecar are checked hourly against the live binary.
Verified claims only. Never production-ready, clustered, replicated or bug-free.
kill -9: 303 of 303 acknowledged writes, and 20 of 20 single-write cycles.The evaluation fixed the CMS and proved it. On 5 Oct the framework release underneath, r61, was brought to Bend 2.0.35 and given the same fix (section 04). These still stand.
The builder's README calls src/ a newer working copy than r61. Joined in order, its parts are the bochtCMS source line for line: the CMS, not a newer framework.
The 2.0.35 build and its 27 checks ran on one Apple-silicon Mac. The builder's Linux binary and manifest are kept as shipped, not rebuilt.
No replication, sharding or consensus, and requests run one at a time, so any slow request stalls every client.
Bend can check proofs about programs. Bocht writes none; its guarantees come from tests and manifests, not types.
The full audit, including the curve, the builder's regressions and the one-function fix, is on the bochtCMS page.
Bend 2.0.35 shipped on 3 Oct. r61 was built on 2.0.32 and stopped building after it, once TCP.listen started taking a host. One line brings it back, and the same pass gives the framework the one-function fix proven in bochtCMS.
TCP.listen(18081) becomes TCP.listen("127.0.0.1", 18081), the form bochtCMS already uses. The native build takes about 20 s.
item197, the shipped snapshot-HMAC probe (forged, flipped, legacy, rotated and 500-write snapshots), passes natively on a Mac for the first time.
The same 90-request replay used for bochtCMS, run on r61 with and without the fix: every response identical.
The REST clap count was read by the same quadratic helper. Same fix, same pattern.
src/ gets the same fix, so joined in order it now matches the bochtCMS source exactly. The builder's Linux binary, manifest and result log are kept as shipped.
Three programs, one young language, one method. Each was written by an AI app builder in Bend 2 under an evidence-first discipline, then handed to Claude Code to check: reproduce every claim, attack it, profile it, fix only what is proven, and show the fix changed nothing else. Every time, the builder's own tests passed, and something real was still wrong.
The framework. A whole backend (HTTP, auth, rate limits, WAL storage, MCP) compiled from one Bend program into one binary.
The app on top. A blog CMS whose only interface is seven MCP tools, and the quadratic curve its 43 passing tests never saw.
The desktop. A single-window shell drawn pixel by pixel in pure Bend: terminal, reader, palette. Ported to a Mac and redesigned.