Learn KEYSTONE: from zero to expert, then sell it

No AI background needed. Five levels, each with something to actually do, at your own pace. Tick items as you go (your ticks stay in this browser).

Evidence, proof and selling tools for KEYSTONE

Level 1 Beginner: understand it

Software teams now let AI write fixes. The AI hands back a change and, in effect, says "trust me". KEYSTONE replaces "trust me" with proof. A rule-based detector (not the AI) finds the defect. An AI model writes the fix. Then a locked-down sandbox runs two tests on the old code and the new code: the AI's own test and an independent test the AI never saw. Only if the independent test fails on the old code and passes on the new code is the fix marked <b>VERIFIED_FIX</b>. Anything less is <b>NOT_VERIFIED</b>.

The result is sealed into a signed, chained record. The client, or their customer, or their auditor, can re-run the check on their own computer with a small program that contains none of our code.

Think of it like this: A building inspector's stamp. A contractor saying "the wiring is fixed" is worth little. An inspector who tested the circuit before and after, and stamped a dated certificate that cannot be altered, is worth a lot. KEYSTONE is the inspector and the stamp; the AI is the contractor.

Read the full plain-English explanation: KEYSTONE, explained.

I read the explanation above.
I can say what it does in one sentence, without notes.

Level 2 User: see it work

Run it live: open the live demo. Before each result, guess what will happen. These are checks it must pass:

Sample: A signature check that never checks the signature: A deterministic detector, not the model, finds the defect the AI is then asked to fix.
Sample: A metric that reports a random number as accuracy: A deterministic detector, not the model, finds the defect the AI is then asked to fix.
Sample: A webhook signature compared with == (timing leak): A deterministic detector, not the model, finds the defect the AI is then asked to fix.
Sample: An alert function that says 'sent' and sends nothing: A deterministic detector, not the model, finds the defect the AI is then asked to fix.
Your code: honest constant-time compare: Real code must grade REAL or nobody trusts the alarms.
Your code: verify() that always says yes: A security check that cannot fail is fabrication.

I ran the live demo.
I can explain what one of these checks shows.

Level 3 Verifier: prove it yourself

This is the skill that sets you apart: you don't have to believe us, and neither do your customers.

Install Python 3 if you don't have it (python.org/downloads).
Download the kit and unzip it.
Open a terminal in that folder. On Windows, click the folder's address bar, type cmd and press Enter. On a Mac, right-click the folder and choose New Terminal at Folder.
Run python3 verify.py (on Windows, python verify.py). It checks the seal without the internet.
Run python3 verify.py --live. It repeats every check from your own computer.
Try to cheat it: open transcript.json in a text editor, change one character, save, and run python3 verify.py again. It must now say FAIL. Unzip a fresh copy afterward.

I ran the kit's check on my own computer.
I changed a file and saw it fail.

Level 4 Expert: know the edges

An expert knows what a product does not do, and says it first. That is what makes a buyer trust you.

Read its limits page in full: what KEYSTONE does not do.

You can say

A rule-based detector, not the AI, decides that a defect exists.
A fix is marked verified only when an independent test fails on the old code and passes on the new.
The record is signed and can be re-checked offline with a checker that contains none of our code.
When the proof cannot run, the answer is NOT_VERIFIED.

Never say

"KEYSTONE fixes any bug": the evidence covers a small number of fixes on one kind of defect.
"Watch it fix your code live on the website": live fixing is off on the public site.
"The proof shows the whole system is secure": it covers that finding and the tests that ran.

Read the questions real buyers send, with honest answers: answers to buyer questions.

Test yourself (click a question to see the answer)

Who decides a defect exists: the AI or the detector?

The detector. It is rule-based; no AI makes that call.

What has to be true for VERIFIED_FIX?

The independent test fails on the old code and passes on the new, and every other check holds.

What do you sell KEYSTONE as, and for how much?

Fix + Prove: $500 small, $1,500 standard, $2,500 complex.

A prospect asks to watch a live fix on the website. What do you say?

Live fixing is off on the public site today; show the live detector and real signed records, and offer to run it on their code.

Why can't the AI's own test be the proof?

The same model wrote the fix and the test, so they can be wrong in the same way.

In the live check "Sample: A signature check that never checks the signature", what answer must come back, and why?

"PARTIAL", "STUB". A deterministic detector, not the model, finds the defect the AI is then asked to fix.

In the live check "Sample: A metric that reports a random number as accuracy", what answer must come back, and why?

"PARTIAL", "STUB". A deterministic detector, not the model, finds the defect the AI is then asked to fix.

In the live check "Sample: A webhook signature compared with == (timing leak)", what answer must come back, and why?

"PARTIAL", "STUB". A deterministic detector, not the model, finds the defect the AI is then asked to fix.

Does a passing kit prove the product is safe for every possible input?

No. It proves what the live product answered to the inputs listed in the kit, and lets anyone check that again.

Has an independent party audited or certified this product?

No. No third-party audit is complete and no certification is held. Say so if asked.

I got every quiz question right without looking.
I can name one thing it does not do.
I explained it to a friend, and they understood it.

Want a formal study path? The CAIN Academy has courses and exams. Finishing this page is your own practice; it is not a qualification or certification.

Level 5 Seller: put it in front of a customer

Copy, paste, send: the shortest route, no technical skill needed.
Who buys it and where to find them.
The sales conversation, then the offer and the close.
The rules: read these before your first message.
Selling tools with this product's evidence built in: pitch, emails, call script, objection answers, one-pager.

I read the rules.
I sent my first personal message.

About money: your share is agreed in writing with FIRME AI CORPORATION before your first message (email vincent@firmeai.com). Nothing here promises income. Most messages get no reply; that is normal.