Done means verified.

/prove collects an evidence bundle the CLI gathers itself: the files git reports changed, plus the real exit codes of your project's own test, typecheck, lint, and build. tomte prove exits non-zero on failure, so it gates a commit hook or CI step.

$ tomte prove
Proof Capsule  ·  2026-06-09 10:58
  files changed   1 (M README.md)
  ✅ test       passed   cargo test
  ✅ typecheck  passed   cargo check
  ✅ lint       passed   cargo clippy
  ✅ build      passed   cargo build
  reproduce: cargo test && cargo clippy

The model never supplies these numbers. It cannot fabricate a green capsule, only explain one the CLI already collected.

record_decision appends the reasoning behind every non-obvious change to a decision trail that is re-injected each session. Next month's session, or a different model entirely, inherits the why and not just the diff. Drift Watch flags a decision the code has moved out from under.

$ tomte why src/parser.rs:88
src/parser.rs:88
  decision  empty input returns Err, not a panic
  why       a library must never crash its caller
  rejected  panic: crashes callers
  recorded  gpt-5.5 · turn 5 · anchor fresh

The trail is an append-only file in your project state. Overturning a decision is recorded as a supersede, never an erase.

tomte twin builds five verifiable indexes straight from the source: import graph, symbol graph, test-to-source map, git recency, and project conventions. tomte why-context answers the question context-stuffing agents dodge: which files actually belong in context, and why.

$ tomte why-context classify_danger
Context X-Ray for `classify_danger`
Selected (would pull into context):
  • tools/shell.rs
      because imports the seed [import]
  • race/judge.rs
      because judge.rs:6 references it [symbol]
Ignored (nearby but left out):
  • tools/web.rs — no path reaches it

Every claim is grounded in a real import edge, definition, test, or commit. A generic name cannot manufacture a false reference.

tomte race runs a task as a tournament: contestants varying model, effort, and style, each in its own isolated git worktree. The judge is deterministic and measures evidence: the project's own checks, diff size, added tests, risky commands run. An LLM is never the referee.

$ tomte race "fix the flaky retry test" --agents 4
🏁 4 contestants · isolated worktrees
  1. minimal-patch   ✅ verified · +test · 38 lines
  2. gpt-5.5/high    ✅ verified · 112 lines
  3. opus-4-8/max    ⚠ checks failed (lint)
  4. gpt-5.5/low     ✖ no change
  winner: minimal-patch (smallest verified diff)
  patch saved · apply with --apply

Ranking is tiered so a clever-but-broken patch can never beat a working one. Every reason on the card comes from measured numbers.