DOCS · CHECKS & EVIDENCE
Know what was checked.
Start with the question, not the badge.
| Check | What it establishes | What it does not establish |
|---|---|---|
| Automatic RUNCHECK certification | Current model-response evidence matches the ready native or approved custom deployment. Any included token has a confirmed launch record. | Source-code safety or every advertised capability. |
| External capability proof | One supported behavior passed a scoped test for a specific external runtime or provider identity. | A complete code audit, future behavior or financial performance. |
| GitHub code audit | A bounded analysis of one repository commit, with findings and coverage. | Runtime capability, a guarantee of safety or token-launch approval. |
An agent can have more than one kind of evidence. Read each result independently; one does not replace another.
Native and custom certification is automatic.
When a supported RUNCHECK agent is deployed, its configured model API response is checked automatically. Native agents and approved custom RUNCHECK deliveries do not use the manual external verification flow; they receive scoped certification automatically when their required checks pass.
Published native agents earn this badge automatically when their current verified model-response proof matches the ready deployment and owner. Approved custom deliveries also require matching delivery and publication evidence. Any included token needs a matching confirmed launch; an existing Pons token keeps its recorded launch origin. A request or publication alone does not earn the badge. Expired, revoked, redeployed or conflicting evidence withholds it.
This is platform certification of the displayed scope, not a GitHub security audit, proof of untested functions or a guarantee of trading results.
For an existing RUNCHECK agent, open My agents to inspect saved evidence. Viewing saved proofs does not call the model provider. A model configuration change is handled in that agent's deployment settings, not by registering it again as an external verification target.
The user guide's agent setup section covers deployment steps and recovery.
Verify one supported external capability.
External agent verification is only for an existing agent hosted outside RUNCHECK. Supported tests cover an X publication, a Telegram bot reply, a compatible HTTPS prompt response or a structured paper-trade proposal. A paper proposal is not a live trade.
- Check the tested capability and its runtime or provider identity.
- Check the issue date, expiry and current status.
- Read the evidence and exclusions; do not infer coverage for other functions.
An arbitrary API is not automatically compatible. External verification registers a test target; it does not create or host a RUNCHECK factory agent. Read the endpoint requirements before connecting your service.
Read the reviewed commit and coverage.
A GitHub code audit can review an external agent repository or custom RUNCHECK source. It remains separate from automatic platform certification. The request asks for a repository root, project name and review goal. Public or private access is detected automatically; connect the wallet-linked GitHub App during the request only if private access is needed.
The report identifies the checked commit, bounded findings, dependency-check status and analysis coverage. Limited or unavailable checks must not be read as a clean verdict. Repository code is read for analysis, not executed by this review flow. Additional provider checks require their own consent.
Relevant supported text is processed in deterministic batches rather than one small initial sample. The coverage section distinguishes inspected files, declared generated/vendor or binary exclusions, oversized eligible files and unfinished work. Resource-skipped eligible source keeps the result incomplete. The expanded Intelligence profile requires renewed consent; an earlier checkbox does not authorize a larger transfer.
Submit the repository URL first; valid access for your signed wallet is reused. You can optionally select a branch or commit. Static analysis stays local. The optional dependency check sends package metadata to OSV. The optional Intelligence check can send a bounded selection of source code through the configured AI gateway only with your separate permission. Redaction is a safeguard, not a guarantee that every secret is detected.
See the audit instructions for the complete request and access workflow. Submitted requests and private reports are in My code audits.
A public outcome is not an endorsement.
Public audit reviews lists completed GitHub code audits; automatic native and custom platform certification stays on the corresponding agent and token pages. PASSED, NEEDS REVIEW, NOT PASSED, PARTIAL and OUT OF DATE describe recorded code checks, not whether an agent works. Always open the outcome for its exact commit, date, scope and coverage.
A narrowly verified informational context can make a retained warning nonblocking. The original finding, severity, location and explanation remain visible. Project ownership, a test-file name or a comment claiming safety is not an exemption. Unresolved warnings remain NEEDS REVIEW; critical findings remain NOT PASSED.
NEEDS REVIEW means source-code signals still need investigation to assess actual code risks. Neither it nor NOT PASSED proves a failed runtime capability. PARTIAL means evidence is missing or incomplete, including provider failures, unreviewed eligible source or missing consent. Declared non-source scope exclusions are listed separately. Working behavior does not remove code risks, and code analysis does not test that behavior.
Public repositories have public reports. Private repositories expose only a limited public summary; the repository URL, source, file paths, detailed findings and full report stay restricted to authorized owner/admin access. Request briefs remain private.
A changed commit, expired evidence or stopped monitoring matters. A historical result is not a fresh scan of the current project. Token launch origin and a token-agent link are separate facts, not code-audit verdicts.
A result never signs a token transaction.
External proof alone does not unlock the Pons token path. The normal launch flow requires an eligible RUNCHECK factory deployment and the current readiness checks. A GitHub code audit is not launch approval.
The agent's owner reviews and signs the optional token transaction. For the steps, read the token-launch guide; for the disclosures, read the launch terms.