The second draft was never wrong.
It was unaffordable.
The advice against rebuilding was written on 6 April 2000, and it says never. The advice was arithmetic, not principle, and half the arithmetic changed. This page shows the work, with the evidence that cuts against us printed beside the evidence that does not.
Doing got cheap.
Proving got expensive.
AI multiplied how fast software gets built. It did nothing for how much of that software you can trust.
Every economic revolution has two layers: the one that does the work, and the one that makes the work count. Agents are the first layer. The second was never built.
Haltere is that layer.
Ten things about rebuilding
that a prepared buyer already knows.
The rule against starting over is real, it was written on 6 April 2000, and we agree with the version that was actually written. What we dispute is its price. One distinction before the rest: the rebuild argued for here is the one you specify and schedule. The rewrite argued against two sections down is the one you fund later because drift accumulated while nobody was looking. Same word, opposite provenance.
Never rewrite from scratch.
On 6 April 2000, rewriting the code from scratch was called the single worst strategic mistake any software company can make, for two stated reasons: “when you throw away code and start from scratch, you are throwing away all that knowledge,” and “you are giving a gift of two or three years to your competitors.” The same essay permits rewriting a function and refactoring a class. Both reasons are prices. Neither is a principle. Joel on Software, 6 April 2000
The second draft was late, not wrong.
In October 1998 the next version of that browser was announced on a new layout engine, which required large parts of the application to be rewritten. It shipped in November 2000. The acquisition of the company was announced the month after the engine decision, so the collapse was already running. And that engine became Gecko, which still ships in Firefox today. Gecko, release history · the acquisition timeline
The variable is the switch, not the rebuild.
A bank moved 5.2 million customers onto a new platform in one April 2018 cutover. On 20 December 2022 it was fined £48.65m, on top of £32.7m already paid in customer redress. The architecture change and the go-live happened together, with no way back. FCA, 20 December 2022
Writing got cheap. Proving did not.
A study of 415 practitioners concludes that “perceived productivity gains may be spurious: surface-level acceleration, often accompanied by redistributed effort and hidden costs.” The effort did not vanish. It moved into review and verification. Verification is the constraint now, and verification is what the line does. The Fast and Spurious, 28 October 2025
We make no claim about speed.
The strongest single study on the other side found 16 experienced developers took 19% longer to complete issues with early-2025 AI tools, on repositories they had worked in for years, while believing afterwards that they had been sped up by about 20%. This argument does not need speed. It needs verification to be the bottleneck, which is the finding every study shares. METR, 10 July 2025
We are not asking you to convert your core.
Across more than 5,400 IT projects with initial budgets above fifteen million dollars, average overrun was 45% on budget while delivering 56% less value than predicted, and 17% went badly enough to threaten the company’s existence. That is a study of programs at an altitude this claim never reaches. McKinsey with the Oxford BT Centre, 2012
“How do we turn this software into our legacy system?”
On an April 2025 panel about core system modernization, one participant described the mistake: “We essentially took our legacy systems and said, ‘How do we turn this software into our legacy system?’” Another: “If I could do it all over again, I wouldn’t look to customize and rebuild the old legacy system.” A third, on a conversion that ran fifteen years: “we didn’t have a strategy about how we would approach it.” Datos Insights, 2 April 2025
Your filed band is on record with the state.
Property and casualty rates and rules are filed with insurance departments and retrievable through the NAIC’s filing access portal. So when the gate checks a proposed factor, it compares it against a number held outside your company, which is the one thing Netscape never had. That is the band, not the whole rater: a filing is not a functional specification, and coverage varies by state and by line. NAIC SERFF Filing Access
Sometimes rebuilding is the wrong answer.
Where the only statement of how a workflow behaves is the thing itself, writing that down is the first part of the work, and sometimes all of it. Two things stay outside the claim in every engagement: your policy admin system and anything else you rent, and the decision to stop using the old artifact. We switch nothing of yours off, and stopping is not deleting.
We have not rebuilt a workflow for a paying customer.
What we can show you is the line, the gate, and a change that was refused. What we cannot show you is a reference. Everything else we have not built is listed with its basis and its date. Capability status
Wrapping your systems buys you a view of them. Building on the line is what puts the transaction on the record.
We did not invent the shape of this. Building the replacement beside the thing it replaces, and moving over when you are ready, is the strangler pattern, written down in 2004. What changed is the price of the second draft, and which half of it is still expensive. The long version, with the exhibits
Secure, tested, merged — and wrong.
The flaws that should keep you up aren’t the ones a scanner finds. They’re the clean ones: code that’s tested, merged, and quietly wrong. A threshold an agent chose because it looked plausible. At machine speed, the coherent mistake is the new epidemic.
A solved market.
Scanners exist. Budgets exist. Haltere runs beside the AppSec stack you already run; its own rails are what gate the merge. Necessary, not the point.
Plausible, passing, wrong.
No scanner catches a wrong answer written in clean code. The receipt makes it attributable for the first time: decision, inputs, authority, prompt, frozen code.
Every shortcut, compounding.
Rot never trips an alarm. It just becomes next year’s rewrite. Haltere makes drift a build failure, so an agent’s shortcut dies in CI instead of metastasizing for three years.
The job was never just blocking bad code. It’s making the next system incapable of becoming a mess.
The field reached the
same conclusion.
We didn’t invent the thesis that proof is the bottleneck. The engineers, analysts, and researchers living it said it first, in their own words.
“The bottleneck moved from writing code to proving it works.”
“In the age of vibe coding, trust is the real bottleneck.”
more time in PR review as individual velocity rose, while organizational delivery stalled.
Mandates for AI coding tools swept the Fortune 500 in months, not years. Agent output now outruns every control built for humans.
Everyone names the gap. Haltere is the thing that closes it.
Governed agents are
cheaper agents.
Agents are expensive for one reason: every session, they re-derive what your system already knew but never stored in a form they could trust. The rediscovery tax, paid in tokens, every session.
The agent re-derives anyway.
Lossy logs and dashboards leave the agent something it still has to verify, so it reads the whole system again, every time. The memory exists; the savings don’t.
It acts without re-checking.
The structure is enforced: the map can’t drift, the receipt can’t lie. So an agent can trust it and skip the rediscovery. Enforcement is what turns context into savings. Trust is the only thing an agent will act on cold.
The record compounds where it runs. Every change deepens what the next agent can trust, and that history can’t be cloned from outside your walls.
The system has to outlive
the people who built it.
Most engineering knowledge lives in someone’s head. When they leave, it leaves. And every new hire pays, again, to rediscover it. A living map ends that tax.
A month of reconstruction.
A new engineer spends weeks reverse-engineering how the system actually works: reading code, pinging whoever’s left, guessing at the parts nobody remembers. The contractor who built the critical path is gone, and the system went dark when they walked out.
Productive in an afternoon.
The map is the system telling the truth about itself: services, operations, permissions, contracts, derived from the code, so it can’t fall out of date. A new engineer reads one source and is oriented in minutes. A new agent reads the same one and starts work. The knowledge is the asset, and it stays.
Turnover stops costing you the system. The map and the receipts are the part you keep.
Six days the receipt gets cashed.
A build layer, the layer that decides what AI-built software may change and proves what it did, only matters on the days it decides money. These are the days visibility fails, because they demand proof.
“Show us what your AI did in Q1.”
Today that’s a full quarter of archaeology across Slack, git blame, and a six-figure consulting bill. With receipts it’s one query, answered in minutes.
The examiner wants a human name.
“A qualified person wrote it, a second person reviewed it” stops being true the day an agent writes the code. The receipt keeps a human name, and a human approval, on every change, by construction.
3 a.m., agent code in the path.
The trace survives the async hops and carries a frozen permalink to the exact code that ran: root cause in minutes, and no “who do we even blame” when no human wrote it.
The department asks what your AI does.
The NAIC Model Bulletin tells insurers what a department may request about their use of AI, and leaves the insurer responsible for third parties acting for it. So the obligation is the carrier’s, and an MGA gets the same questions from the carrier that delegated the authority. The program is yours to write. The evidence that you followed it is one query. NAIC Model Bulletin, adopted 4 December 2023 · what it asks for
Someone tries to buy the company.
Un-explainable code gets treated like un-audited financials. Software that carries receipts diligences in days and defends its multiple.
The contractors leave.
The knowledge usually walks out with them: months of ramp to rebuild. With Haltere the map and the receipts are the asset you keep: alive, enforced, compounding.
Visibility is for the good days. A receipt is for the day someone asks.
The one layer the giants can’t ship.
A build layer only works if it’s neutral: model-agnostic, cloud-agnostic, portable, and yours. That’s exactly what a model vendor or a cloud can’t build: a record that travels freely undercuts the lock-in their whole business runs on. And the party being audited shouldn’t own the auditor. So the layer that proves AI-built software won’t come from the people selling the agents. It has to be neutral by construction.
Built for the people who
answer for the work.
“I’m attesting to code that nobody in my organization wrote.”
Every AI-touched change carries a provenance record and an enforced policy path. Your signature sits on evidence, not hope.
“We bought speed and created a queue we can’t triage.”
Receipts make every change tierable by recorded risk: what the agent saw, was allowed to do, and did. Review lands where it matters. Upstream, the rails fail the build: a crossed boundary or a broken contract never reaches the queue. And when a request misbehaves, the trace runs end to end, through the async hops, to the exact line that ran.
“The framework assumes a record that doesn’t exist.”
With Haltere the record was never not being kept. The technical file becomes an export, not a quarter of reconstruction.
“I finally have the AI budget — and no safe way to point it at production.”
Map what you move onto the line. Gate what you build. Let agents work inside constraints, so trust becomes a number instead of a feeling.
What you’ll want to know.
Is Haltere another coding agent?
No, and we won’t build one. Bring the agents your teams already run. Haltere is the floor they work on: the map they read, the scopes that constrain them, the gates they can’t bypass, the receipts they leave behind.
Where does it run? Our code can’t leave.
It doesn’t. Built to run inside your trust boundary: self-hosted or your private cloud, air-gap on request, with the model port as the contract. That’s the architecture, not an enterprise add-on.
We’re drowning in legacy. Greenfield only?
Greenfield, on purpose, and one workflow at a time. A rule can only be enforced inside software built to run it, so enforcement starts at what you build next: the rater, the intake, the bordereaux, the report that runs on one laptop. Your policy admin system is not converted and not touched, and nothing you rent from a vendor is replaced. Governed services accumulate beside legacy, legacy retires on your schedule, moved onto the line piece by piece, and we switch nothing of yours off.
We already have governance in our code platform. Why isn’t that enough?
Keep it. Your CI is where the gate runs. Platform logs record platform events: who merged, when CI passed. None of that records the AI decision: what the agent saw, which prompt version drove it, what it was allowed to do. And evidence that lives inside one vendor’s walls is a tenant, not a record. Yours is portable.
What’s the lock-in?
Inverted, deliberately. When an engagement ends, you keep the asset: the map and the receipts stay in your environment, in open, queryable formats, and the logic built on top is yours. Walk at renewal with everything. We expect to be judged on that sentence.
What does a pilot look like? And isn’t this just consulting?
One workflow, 4–8 weeks, fixed fee scoped before anything starts, live in your environment. The key: it’s our scaffold stamped once, passing the gate green out of the box, with the seams for the audit trail and the receipts already in place and the bodies yours to fill, not a custom build that scales with bodies. That’s the difference between us and consulting: every new governed service is a copy of the same unit, not a bespoke project. It ends with the workflow running governed and your audit story answered in one query.
Start with one workflow.
Bring the workflow you have to build and cannot staff. We stand it up as a governed service: scaffolded onto the same line every time, the same line every time. You keep the map and the receipts. Thirty minutes, with the engineers who build the line: you name the workflow and the examiner you answer to, and we tell you what a governed build of it looks like, what it costs, and when it can start.
Inquiries are answered within one business day, by someone who can answer them.
