AstralXVoid/NoWreck
Sponsored · FeaturedCLILive in productionA deterministic verifier for AI coding assistants.
A CLI tool that verifies AI coding assistant claims against actual structural changes — catching hallucinated functions, fake calls, and missed modifications before they ship.
- Python100.0%
1 Review
NoWreck tackles a real problem in AI-assisted development: checking whether an agent’s explanation matches the code it changed. The strongest part is the pre/post verification mode. It scans actual Python and JavaScript files, builds symbol indexes, detects structural changes, and compares those facts with specific claims. The narrow scope is a good choice because the project does not pretend to judge code quality, correctness, or intent. It reports uncertain cases as unverifiable instead of guessing. The codebase is cleanly divided into scanners, detection, claim parsing, verification, reporting, model access, and configuration. It also has broad test coverage, strict type-checking settings, linting rules, interactive and JSON output, detailed limitations, release notes, and a clear roadmap. The FSL license terms are explained plainly instead of being hidden behind a license-file link.
The biggest isue is prompt mode. The README says NoWreck calls a model, receives changes and claims, and verifies them. In the current code, however, the detected changes are created directly from the model’s own claims. Those claims are then checked against the changes derived from those same claims. This does not verify an actual repository or diff, so it can create a misleading confirmation loop. Prompt mode should apply or receive a real patch, scan the before and after states, and verify the claims against those independently detected changes. Until then, the README should clearly label it as claim formatting or simulation, not deterministic verification. The repository would also benefit from GitHub Actions, contributor and security guides, and safer API-key handling because the local config command can store and display keys in plain text. Documentation should resolve its Python requirement mismatch too, since the README says 3.10+ while the package requires 3.11+. Overall, NoWreck has a strong concept and a solid deterministic core. Fixing the prompt-mode trust gap would make its central promise much more credible.
Thank you so much for taking the time to review NoWreck so thoroughly. I really appreciate the detailed and constructive feedback. I’m especially glad that the deterministic pre/post verification, narrow scope, architecture, testing, and explicit handling of unverifiable cases came through clearly. Those were deliberate design decisions, so it means a lot to see them recognized. Your criticism of prompt mode is particularly valuable. I agree that deriving detected changes from the model’s own claims creates a circular verification path and weakens the trust model. The recommendation to use an actual patch or independently scanned before/after states is exactly the kind of architectural feedback I was hoping the project would receive. I’ll be treating this as a priority rather than glossing over it. I’ll also address the documentation mismatch around Python versions, improve API-key handling, and look into adding GitHub Actions, contributor documentation, and a security guide. Thank you again for going beyond a surface-level review and actually examining how NoWreck works. This gives me a much clearer direction for strengthening the project and making its central promise more credible.