Done with you · fixed fee
Two weeks. Every agent you run, graded against the standard.
You get a level, the evidence behind it, the findings ordered by real risk, and the specific changes that move you up a level — run by the standard’s first implementer, with the same instrument that convicted our own system twice in public. Fixed fee, from $9,500, scoped in one call. Your code never leaves your environment.
You run three or more agents in production, in an environment where “trust me” is not a permitted answer, and someone — a board, an auditor, a customer’s security team — has started asking for evidence.
Not you yet? Then don’t buy this. Run the free probe and come back when it is — the free tier is the whole method, and it will tell you the truth.
Four artifacts
The conformance verdict
Your level on the GOVENANT ladder with the complete evidence trail behind it — every probe, every query, reproducible by your own engineers. Structure and pulse: what the code makes possible, and what the record proves actually happens.
The gap register
Findings ranked by real exposure — not alphabetically, not by count. Each carries the pattern name, the log signature we found, and what it costs you if it surfaces in an incident or an audit first.
The remediation plan
The specific structural changes that move you up a level, mapped to the three laws and sequenced by leverage — most fleets’ first jump is verified-outcome rows plus a validation gate at the chokepoint.
The board-ready one-pager
The page your CISO can actually forward: what was audited, what was found, what’s being done, and what you can now evidence — because that page is what the buyer is personally being asked for.
Security posture
- Read-only access — the audit never writes, never retries jobs, never touches configuration. SELECT-only, enforced by discipline and by tooling.
- Your environment — code and data never leave it; the instrument comes to you.
- No training on your code. Ever.
- NDA before scoping — standard, ours or yours.
- Findings are yours — you decide what, if anything, is published. (Publishing to the registry is available, never required.)
Fixed fee, sized to fleet and substrate count in one scoping call — you’ll leave the call with the exact number, in writing. Two weeks from access to artifacts.
Prefer email? Contact us with “expert audit” and your fleet size — 11+ agents in production goes straight to the founder.
The audit produces a self-assessed conformance level with its probe log — publishable to the public registry and open to challenge. It is not a certification, and we will never call it one: no certifying authority exists, including us. What you get is stronger than a stamp — a reproducible record.