trace.app
playable

a1f3c9e

commit

diagnosis

three questions

does it run?supported
is it built?concern
is it safe?not proven

evidence coverage · read-only

Three questions, each answered supported, concern, or not proven — with evidence for every finding and no made-up score.

see how it works →
Komatik Trace
diagnosticai-built-appscode-health

Trace

2026-10-16 / projects/trace.mdx

Find out what your AI-built app can actually support. A read-only check of one exact commit that answers three questions: does it run, is it actually built, and what safety concerns are evidenced.

Trace tells you what your AI-built app can actually support.

The typical case: someone built a working prototype with Lovable, Bolt, v0, Replit, Cursor, or Claude Code, and now needs to know whether it's ready for real users, real data, and real money. Trace reads one exact commit of the repo — read-only, with your authorisation — and answers three questions.

The Three Questions

  1. Does it run? Trace builds and starts the app at that exact commit and keeps the evidence.
  2. Is it actually built? Or is it a convincing shell — placeholder handlers, fake data, screens with nothing behind them?
  3. What safety concerns are evidenced? Security problems AI-generated code tends to leave behind, plus ownership and review depth.

Each answer is supported, concern, or not proven. A missing check never quietly becomes a pass. Every finding keeps its provenance — repo, commit, check, Trace version. If a percentage shows up, it's evidence coverage, not a grade. There is no health score, on purpose.

Trace never pushes code and never certifies an app as safe. A person reviews the result, and the next step is either a scoped rescue quote or a request for more evidence.

Since May

  • One product (May). Four separate tools — Floe for security, Drift for codebase health, Traverse for change review, and Watchtower for AI governance — were folded into Trace. Security scanning and codebase health are live inside it; change review and governance are on the roadmap.
  • Recovery playbooks (May) for apps that started in Lovable, Bolt, Replit, Cursor, v0, and Claude Code.
  • Commit-bound assessments (Aug). One trace assess, shallow or deep, pinned to an immutable commit.
  • The three-question diagnosis (Aug), with rules for spotting hollow implementations and scanner precision tuned against real outside repos.
  • Runtime proof (Aug). Exact-commit build-and-start evidence from clean hosted runners, with plain-language hints when a phase fails.
  • A new front door (Aug). trace.komatik.xyz, with read-only repository authorisation through a GitHub App.

Status

Public scans open once ownership checks, hosted proof, and calibration are ready. The first lane is React and Next.js apps on Supabase.