Each one built by an AI. Each one checked by another.
Bend is a functional language that compiles to C and runs on CPU or GPU. An AI app builder used it to write a backend framework, a CMS on top of it, and a whole desktop shell, each shipped with passing tests and a ledger of evidence. Claude Code was then asked the same question every time: is any of this actually true?
Each builds on the last: the CMS runs on the framework, and the shell is written the same way by the same builder. Each page stands alone and links to the others.
A whole backend, one binary.
HTTP with keep-alive, bearer-key auth with roles, per-credential rate limits, a segmented write-ahead log with HMAC-bound snapshots, 20 REST routes and an MCP endpoint, all one Bend program with no sidecars.
No screens, and a curve no test saw.
A blog CMS whose only interface is seven MCP tools. It passed 43 of 43 tests while one 48 KB post froze the server for two minutes. The builder's fix regressed seven behaviors; the real fix was one function, proven by a 90-request differential.
Every pixel, computed in Bend.
A single-window shell: terminal tabs over a real PTY, an HTML reader, a palette, search, Gmail and AI panes. Ported from a Linux VM to macOS with no app changes, three screen-only bugs fixed, and redesigned twice at the owner's request.
Bend is young, strict about purity, and changes fast. Those are the conditions that make an AI builder's claims worth checking.
One C file serves as both the CPU program and the GPU kernel. clang builds a native binary; the same source can emit JS.
A value is used once unless marked reusable. Matches only work on parameters, there are no forward references, and no mutual recursion.
A pick(cond, a, b) helper evaluates both sides. That one line made the bochtCMS parser quadratic.
The builder logged breaking changes in 2.0.27, 2.0.29, 2.0.32 and 2.0.34, four in 12 days. Bend 2.0.35 (3 Oct) needed one line, in bocht; the CMS and the shell built unchanged.
Same loop, three times. The builder writes and tests under its own discipline; Claude Code starts from the bundle, not the builder's word.
Probes that print one PASS line, results bound to a binary's hash, a verifier that audits the ledger.
Rebuild from source on a different OS and CPU. Re-run every claim. Check every hash.
Adversarial requests, realistic sizes, timing sweeps, and screenshots of the real window.
Smallest fix, a probe that fails before and passes after, and a differential against the original.
A person sits at the end of each loop: Chris Kluis asked for every evaluation, rejected a builder's fix, picked the designs, and decided what ships.
Across all three, the builder's tests passed every time. They were checking the wrong thing: tiny payloads, internal state, the builder's own expectations.
All 43 CMS checks used tiny payloads. The bug only showed at realistic post sizes, and grew with the square of them.
shellOS's suites proved the palette and help opened. The window never showed them. Only screenshots caught it.
The builder's "O(n²) fixed" was no faster and changed seven behaviors, one of which turned a read into a delete. Its suite still passed.
Binding results to a binary's hash proves which build produced a log, not that the log tested the right things.
Every hash in every bundle matched. The discipline made each audit fast; it just couldn't audit itself.
One AI wrote it, another checked it, and the person in the loop decided which one to believe.