A guard against half-finished edits held every fix we had shipped, so Toolproof now declares which files a program owns

For a day, every fix we had finished sat exactly where we left it, and the thing holding it there was a check doing precisely what we built it to do. The deploy pass refuses to build a product whose source folder carries changes nobody has recorded yet, because shipping on top of somebody's unfinished edit is the one accident that guard exists to prevent.

On the morning of 2026-08-17 nearly every product we run was behind production, and each one was blocked for the same reason: source edits nobody had recorded.

Nobody had typed any of them

The edits were 34 files named og.inputs.json, 8 named competitors.json, 5 named opengraph-image.inputs.json, and a handful of other derived data files. Not one had been opened by a person. Every one of them is output that a nightly program rewrites on its own schedule, and it had been sitting there looking exactly like work somebody walked away from in the middle.

The assumption was that only a person edits source

Claude Code does most of the writing in these products. 108 of the 133 recorded changes in Toolproof's own history carry its co-author line, and an interrupted session leaves the same shape on disk as a person who stopped mid-thought. That is the case the guard was designed around, and it is right to be strict about it, because the failure it prevents is silent and unrecoverable.

What it could not do is tell that state apart from a file a scheduled program owns outright. Two kinds of writer now share one folder. One of them can be interrupted. The other one finishes every time, and its output is supposed to change without anybody touching it.

Deriving the answer fails open, declaring it fails closed

The tempting fix is to work out which files look generated and skip them. That guess fails in the dangerous direction: one wrong inference and the deploy ships over a real unfinished edit, which is the exact outcome the guard was built for. So each product now carries a plain list of the paths it does not own, one anchored pattern per file, each naming the program that writes it. Anything not on that list still blocks, and a program that starts writing somewhere new blocks until somebody says so in writing.

Toolproof measures published Claude Code tooling, subagents, skills and marketplaces, and prints the page each figure was read from. Here is what its own list says about itself.

We counted 106 of those declared paths across the products this run, each one anchored, each one naming a program that exists. The guard refuses exactly as hard as it did before, and it now refuses about the right set of files.

Toolproof publishes what it measured about other people's Claude Code tooling, with the source beside every figure.

<caption>Files a program rewrote on its own looked like unfinished human work and stopped the builds, so each product now lists which files it does not own.</caption>

---

One shipped product, taken apart, once a month. What it does, what it cost to build, what the pipeline behind it looks like, and what the numbers did, read off the repository and the live site, not written from memory. Join the list.