Read-only conformance verification for governed code.

Idora verifies each change against the requirement that governs it.

Then it seals the determination so you can inspect it yourself.

determines every governed change · seals the evidence · earns enforcement only after measurement

reference example · read-only demo · no repo access
The governed requirementLogin attempts must be rate-limited to 5 / min per IP.
Determinationdoes_not_conformsrc/auth/rate-limiter.ts:67 · loginLimiterlimiter keys on user-id only - IP rotation bypasses the cap.
read against commit 4c1f9ab
receipt · sealedsha256:1fe4759e0878554b7e74tamper-evident id of the sealed record - recompute it on the card to confirm it's unaltered →
Disposition · by designnot eligiblesealed · stable · fresh
measured bar · not available
-> inform-only

This is the kind of gap diff-level review often misses: the limiter looks right, but it does not satisfy the requirement that governs it.

The result is not a review comment. It is a sealed conformance determination with a disposition.

Inspect the Reliability Card

Idora informs first. It is read-only, changes nothing in your repo, and will not enforce until accuracy is measured for that requirement class.

A determination earns the right to block a merge only once its requirement class clears an accuracy bar fitted from labeled data, so confidence alone never becomes a gate.

Build attestations show where software came from. Idora shows how a code obligation was determined.

For data access, retention, and deployment details, see Security.