CodeClone @codeclone_app

@victornunez A little ironic: CodeClone was accepted into Claude for Open Source, but despite applying to Codex for OSS several times, I still haven't made it in. I'd genuinely love to bring CodeClone's deterministic structural verification to the Codex ecosystem. Maybe next time? ♥️

CodeClone's published dependency constraints already allow patched certifi versions. In our current development branch, we're updating dependency locks, enforcing safe version floors and strengthening CI and release-chain verification. The entire trust chain matters. Not just the application code.

certifi isn't a direct dependency of our core projects. But transitive dependencies, development environments and release tooling are part of our security boundary. We've already shipped updated releases of ckdn and PyTMBot.

We’re taking the eMudhra CA compromise seriously. For Python, this goes beyond updating certifi. pip and uv have their own certificate trust mechanisms. OS trust stores, virtual environments and container images add more layers. Security doesn't stop at direct dependencies.

Reports & release quality We're fixing inconsistencies between machine-readable results, CLI output, and HTML reports. And testing the analyzer against external Python projects, including cases designed to falsify its assumptions. 2.1.0a2 isn't abandoned. We're making its foundations trustworthy. We'll share progress more consistently.

We owe you an update on CodeClone 2.1.0a2. It's taking much longer than we expected. And going quiet while people wait for a release isn't fair. The scope grew. We uncovered deeper correctness issues and chose to fix them rather than ship results we couldn't fully trust. That's on us. No new ETA until we can back it with evidence. We're still here. Still building. And we owe you more transparency along the way.

Engineering Memory & agent workflows CodeClone is growing beyond a standalone analyzer. We're strengthening evidence provenance, change-control receipts, and Engineering Memory. An agent's claim, a human decision, and a verified fact must never silently become interchangeable.

Storage & change verification We're rebuilding how analysis results are stored, compared, and verified against baselines. This includes detecting newly dead code, changes in dependencies, and structural regressions. A baseline must preserve actual findings, not merely the list of things examined.

Determinism & identity The same code, analyzed under the same contract, must produce the same semantic result. We're tightening report identity, canonical representations, and cache correctness. No stale verdicts. No accidental changes caused by execution details.

Dead-code detection We're making LIVE, DEAD, and UNRESOLVED genuinely different conclusions. Dynamic Python makes this difficult. A matching name doesn't prove a reference, and missing evidence doesn't prove dead code. When CodeClone can't establish the truth, it must say so.

Structural analysis We're rebuilding how CodeClone understands Python code: definitions, references, imports, bindings, and dependencies. The goal isn't to find more issues. It's to make sure every reported issue is backed by actual structural evidence.

@claudeai No stock footage, no samples, no video editor: Opus drew the paper puppets, animated them at 12 fps, composed the tune and synced every pop, rip and "ta-da" to the picture.

@claudeai The film is about CodeClone, my open-source tool that keeps AI agents' code changes explicit, bounded and verifiable. uvx codeclone@latest . github.com/orenlab/codecl…

Still amazed by Opus 5.5 from @claudeai As an analyst and as an animator, this model really delivers. Haven't tried it for dev work yet — but look what it made entirely on its own: a stop-motion film, music and sound included 🎬🎵 Every frame and every note is code.

@AnthropicAI Fun part: no video editor involved. Opus wrote the whole animation in code, invented its own character (the yellow one with the giant pencil) and turned the CodeClone logo into the inspector with the stamp.

@AnthropicAI CodeClone is a deterministic structural change controller for AI agents: the agent declares intent up front, and the patch is checked against repo facts — not an LLM's opinion. Open source, runs locally: uvx codeclone@latest . github.com/orenlab/codecl…

Like everyone, I had to try Opus 5.5 from @AnthropicAI 👀 So I asked it one thing: show me how you see working with CodeClone. It came back with this — declared intent, a fence around the edit, a sneaky detour, BLOCKED, a fix, VERIFIED 🎉 Honestly? That's exactly the loop.

A note on CodeClone 2.1 and why it hasn't shipped. The 2.1 line was planned as a contract rework. During the alpha, the corpus and benchmark work exposed something bigger: the way analysis results were identified, cached and served across surfaces was not solid enough for a tool whose entire value is deterministic facts. On large repositories with several agents running, it showed. Shipping on top of that would have moved the problem to users. That's not the deal this project makes. So 2.1 became a rebuild of those foundations: one analysis state that persists instead of being recomputed, a clear line between a fact, a comparison and a judgment, and every consumer — CLI, MCP, IDE, CI — reading the same canonical data. The cache is already rebuilt and measurably faster; the rest is in progress with most of the surface now frozen. 2.0.2 remains the stable release and gets fixes. 2.1 ships when it holds up on real repositories, not before. That's the whole story. More soon, with numbers.

Everyone's excited about Jev: a model that scores an agent's decision in 400ms. Good. But it reads what the agent wrote. It can't see what the agent did. A diff answers one question: what changed. It can't tell you whether the agent stayed in scope, what it read before it drifted, or whether "done" means what you asked for. CodeClone answers those before the model ever gets a vote — deterministically. Intent declared up front. Blast radius mapped. Boundary set. Then the real patch is checked against what was promised. Every step lands in an audit trail. No LLM decides if a change is safe. It either computes the fact or says it can't. Fast judges are welcome. Put them on top of facts, not instead of them.

Let my ChatGPT Plus subscription lapse this month. For Codex, the usage limits make it effectively unusable for real work. For chat alone, the plan is more than I need. Meanwhile, the Claude for Open Source program covers everything I currently require — a measured thank-you is in order. OpenAI's equivalent program doesn't appear to fit projects like mine, so for now I'll be watching their frontier models from the sidelines.