Start, close the review loop, then add continuity.

00 / Access and download

Trusted public downloads are the paid-access gate.

The checksum-verified preview is available without an account for the disposable guided sample and one real local candidate review. It inspects the repository read-only, lets you select a discovered base and candidate branch, performs bounded non-executing checks, shows exact hunks, records Review Coverage, and exports a source-free correction brief plus checksum passport. The source checkout remains unchanged, project tests are not run, and repository content never reaches Veyact. The one preview review remains inspectable on that installation; another review, a rerun, agent launch, recurring history, and Pro continuity require enrollment. Windows signing and macOS notarization remain incomplete, so these packages stay labelled preview. Subscriptions remain unavailable until platform trust and commerce checks pass. No subscription trial is offered.

01 / Quickstart

Two verified formats, one device-bound local app.

# Windows PowerShell: refuse a checksum mismatch
$expected = ((Get-Content .\runrail-desktop-v1.zip.sha256) -split '\s+')[0]
$actual = (Get-FileHash .\runrail-desktop-v1.zip -Algorithm SHA256).Hash
if ($actual -ne $expected) { throw "Runrail archive checksum mismatch" }
Expand-Archive .\runrail-desktop-v1.zip .
cd .\runrail-local-v1; .\START-RUNRAIL-PREVIEW.cmd

# macOS
shasum -a 256 -c runrail-desktop-v1.zip.sha256
unzip runrail-desktop-v1.zip
cd runrail-local-v1 && ./Start\ Runrail\ Preview.command

# Linux / WSL2
sha256sum -c runrail-local-v1.tar.gz.sha256
tar -xzf runrail-local-v1.tar.gz
cd runrail-local-v1 && ./start-runrail-preview.sh

runrail doctor --json
runrail sample --json

cd /path/to/repository
runrail desktop --repo .

# Or print the same read-only readiness result in the terminal.
runrail readiness --repo . --base main --json

# Preview Desktop returns local branch choices and permits one candidate review.
# Inspect exact hunks, save Review Coverage, then export the source-free brief
# and checksum passport. The source checkout remains unchanged.
# Enrollment is required for another review, rerun, or recurring history.
runrail license request --json
# Select the public request in the subscriber console, then enroll with
# its downloaded single-use ticket.
runrail license enroll \
  --ticket /absolute/path/to/ticket.json \
  --json
runrail license --json

The fixed preview launcher accepts no repository, command, path, provider, or environment input. It installs Runrail, runs integrated doctor, completes the disposable sample, opens Desktop, and prints the exact desktop --repo . command for the installed copy. Run that command from a local Git worktree; the CLI resolves . once, while the Desktop server and loopback API continue to require an absolute path. The operator may also use runrail readiness --repo . for terminal-only read-only inspection. In Desktop, preview mode may persist one isolated local candidate review: select a discovered base and candidate, run the fixed non-executing verifier, inspect exact hunks, save Review Coverage, and export the source-free correction brief and checksum passport. It cannot run a second review, rerun the candidate, launch an agent, import external evidence, create a device signature, run project tests, upload source, or mutate the checkout. Subscriber history is stored separately from preview evidence. The top-level START-HERE.txt identifies the correct launcher; opening desktop/index.html directly shows a recovery screen because that internal file cannot create a private session. The installer never edits PATH or shell profiles; its JSON nextCommands output still provides exact full-path commands for manual operation. Every checksum command refuses a mismatch before extraction. Device enrollment sends only a signed public request and entitlement metadata; repository content remains local. Requirements: Windows, macOS, Linux, or WSL2; Node.js 20+; Python 3.11+ with venv; Git; and brief subscriber-service access only after enrollment.

02 / Candidate review

Run one bounded preflight in the app or CLI.

runrail review --repo /path/to/clean-repo \
  --base main \
  --candidate ai/candidate-change \
  --verifier safe-static \
  --json

Runrail reads the optional review contract from the selected base commit, materializes the candidate in an isolated local review directory, performs bounded policy checks plus non-executing Python, JavaScript, JSON, TypeScript, TSX, and JSX validation, blocks the preflight when changed source types are unsupported, and leaves the source checkout unchanged.

03 / Output files

Six primary files plus focus and coverage evidence.

04 / Review Focus

Start with the work that blocks a safe decision.

runrail focus \
  --audit /absolute/path/to/review/audit.json \
  --json

Every review already creates the plan. This command verifies or rebuilds it from one Runrail-owned audit. The canonical order covers blocked preflight repair, base-owned contract evidence, specialist review, approved project checks, manual patch inspection, and the final human decision. It works for passing and blocked preflights, opens no repository, uses no model or network, executes nothing, mutates no source, and grants no authority.

05 / Review Coverage

Carry attention only when the exact hunk survives.

runrail coverage \
  --audit /absolute/path/to/review/audit.json \
  --json

# For a related revision, use the prior immutable coverage:
runrail coverage \
  --audit /absolute/path/to/revised/review/audit.json \
  --previous /absolute/path/to/prior/coverage.json \
  --json

Every review starts with each textual hunk unreviewed. Runrail Desktop can save a path-free attention snapshot with reviewed, needs-revision, or unreviewed per opaque hunk. State carries only across a bound same-base or linear-successor review when the exact file scope, hunk header, context, and changed bytes occur exactly once in both artifacts. Changed, shifted, split, duplicated, ambiguous, and new hunks reset to unreviewed. Attention is not correctness, approval, or merge readiness; Coverage opens no repository, runs no test, calls no model, and mutates no source.

06 / Agent Assurance

Give any coding agent exact objectives, then verify the revision.

runrail handoff \
  --audit /absolute/path/to/prior/review/audit.json \
  --json

runrail assure \
  --packet /absolute/path/to/agent-assurance/packet.json \
  --before /absolute/path/to/prior/review/audit.json \
  --after /absolute/path/to/current/review/audit.json \
  --coverage /absolute/path/to/current/coverage.json \
  --json

handoff exports fixed product-authored correction objectives without repository identity, source, diff, paths, refs, commits, raw verifier output, or provider keys. assure accepts only a checksum-bound packet plus related Runrail-owned evidence and classifies resolved, remaining, new, and reintroduced findings. A result can say ready-for-human-decision only when the current preflight and base-owned contract pass, no required or new high/medium finding remains, and verified current Review Coverage has no unreviewed or needs-revision hunk. Neither command runs a coding agent, executes project tests, applies code, changes policy, calls a model, or approves a merge.

07 / Starter: external evidence receipts

Bind existing tool summaries without executing them.

Runrail accepts bounded SARIF 2.1.0, strict JUnit XML, and LCOV summary files for the exact reviewed candidate revision. It verifies format, size, checksum, and revision binding, then stores a path-free aggregate receipt. Raw evidence is not persisted. Importing evidence executes no command and cannot independently change the deterministic verdict or Agent Assurance result.

08 / Pro: Revision Workspace

Map what must be reviewed again.

runrail recheck \
  --before /path/to/prior/review/audit.json \
  --after /path/to/current/review/audit.json \
  --previous /path/to/prior/coverage.json \
  --json

# Export the finding and priority comparison separately when needed:
runrail compare \
  --before /path/to/baseline/review/audit.json \
  --after /path/to/revised/review/audit.json \
  --json

The Desktop Revision Workspace and installed runrail recheck command are licensed for Pro. Recheck verifies both audits, their same-base or linear-successor relationship, the base-owned contract basis, and prior Review Coverage before carrying only exact unique hunk attention. It writes a path-free Re-review Map with finding deltas, current attention required, and a fixed human review sequence. The free browser workspace can compare related audit files without purchase, while runrail compare exports the separate deterministic comparison.json, REVIEW_COMPARISON.md, and script-free comparison.html artifacts. This is deterministic triage evidence, not a code-quality score. Neither path runs project tests, proves correctness, mutates source, or approves a merge.

09 / Pro: Evidence Continuity

Track deterministic findings across related revisions.

runrail lineage \
  --audit /path/to/first/review/audit.json \
  --audit /path/to/next/review/audit.json \
  --audit /path/to/latest/review/audit.json \
  --json

Evidence Continuity verifies 2 to 20 Runrail-owned audits, their adjacent relation, contract basis, and content checksums before writing path-free lineage.json, REVIEW_LINEAGE.md, and script-free lineage.html. It shows finding absence and recurrence without opening a repository. The sequence order is operator-declared; its integrity chain does not authenticate creator, time, order, or append-only history.

10 / Pro: Candidate Tournament and ProofGraph

Choose review order, then inspect the evidence chain.

Candidate Tournament reviews two to five existing candidate branches against the same confirmed base, base-owned contract, equal contract budget, and equal safe-static verifier budget. It exports a concise receipt explaining why one candidate should be reviewed first. It ranks human review order only; it never selects a branch, scores code quality, or recommends a merge.

ProofGraph connects verified revisions, contract rules, evidence, findings, exact-hunk attention, and append-only dispositions. Every finding remains visible; a disposition never silently suppresses evidence or changes policy. Both artifacts are path-free and checksum-linked, run locally, and add no project-test, network, source-mutation, model, apply, or merge authority.

11 / Pro: Agent Outcome Ledger

Measure verified revisions, not agent promises.

After a verified rerun, you may explicitly label the coding agent as Codex, Claude, Gemini, Grok, or Other. Runrail stores repository-local counts for revisions-to-ready, resolved, remaining, new, and reintroduced findings, evidence completion, sample size, and uncertainty. It never records agent output, publishes a global model score, ranks agents across repositories, or claims one agent writes better code.

12 / Local product metrics

See whether the assurance habit is actually forming.

Runrail records checksum-verified local events for activation, review, rerun, completed assurance, and passport export. The visible North Star is completed assurance loops per active repository per week. Raw events remain on the device. Optional daily aggregate upload is implemented but disabled by default and requires explicit consent. It accepts only aggregate counts, duration buckets, platform, plan, and product version; repository identity, paths, refs, commits, findings, prompts, source, diffs, agent output, provider data, and contact details are rejected.

13 / Candidate recommendation

Offline first, optional model second.

runrail recommend \
  --audit /absolute/path/to/runrail/review/audit.json \
  --json

The default path is deterministic, transmits nothing, and needs no model or key. To request the optional DeepSeek second opinion:

export RUNRAIL_DEEPSEEK_ADVISORY_ENABLED=true
export RUNRAIL_DEEPSEEK_ADVISORY_API_KEY='your-own-provider-key'
runrail recommend \
  --audit /absolute/path/to/runrail/review/audit.json \
  --provider deepseek \
  --allow-network \
  --json

$env:RUNRAIL_DEEPSEEK_ADVISORY_ENABLED = "true"
$env:RUNRAIL_DEEPSEEK_ADVISORY_API_KEY = "your-own-provider-key"
runrail recommend --audit C:\absolute\path\to\runrail\review\audit.json --provider deepseek --allow-network --json

DeepSeek remains optional. It receives bucketed counts and booleans, not source, diff content, paths, file names, commits, repository identity, task text, raw verifier output, or the audit run id. It may return only fixed candidate IDs or ABSTAIN; the receipt keeps authority: none, and a human decides what happens next.

14 / Safety model

Fail closed at the repository boundary.

Runrail requires a clean source repository, rejects unsafe refs and paths, reads policy only from the selected base commit, accepts fixed verifier profiles, and stops before automatic apply.

15 / Limitations

Know what the result does not prove.

No project tests, semantic correctness verdict, complete security review, authenticated evidence origin, operating-system sandbox, or automatic apply. Run your own test suite before merging.

16 / Uninstall and recover

Remove managed files without deleting review evidence.

Run node .\uninstall.mjs on Windows or ./uninstall.sh on macOS, Linux, and WSL2 from the verified extracted package. The packaged Windows uninstall.ps1 wrapper remains available and lifecycle-tested. Runrail verifies its checksum-bound ownership state, refuses changed or symlinked managed paths, and preserves the local workspace and audit evidence by default.

If .v1-backup remains after an interrupted update, rerun the verified installer first. It restores the prior verified release before continuing; uninstall remains closed until recovery finishes.

17 / Troubleshooting

Start with the doctor.

Run the installer JSON value at nextCommands.doctor. Confirm package integrity, supported runtimes, a clean Git repository, and an existing candidate branch.