s opstopper coherent ≠ correct
Plumb, the plumb-line character

01 / plumb-line

Values that remember where they came from, and review tooling that detects when they don't.

So you'll know it's dirty before it's a decision.

● in usev0.11.2 JS + Pythonzero deps
Install → Repository ↗

Where values come from

Once it is in a variable, they all look the same.

Every value in a program came from somewhere: a database, an API call, a test fixture, a default, a guess. Once it is sitting in a variable they all look the same. That is how a stubbed service answers "success" and the tests go green, how a guessed field flows into a report, and how a fallback an agent wrote to get a test passing ends up behind the dashboard, weeks after anyone remembers it is a fallback.

plumb-line finds those places, and can stop new ones from appearing. A set of review-time tools (a Claude Code audit skill, lint rules, git hooks and a GitHub Action) checks a repository or a pull request for mocks treated as real, guesses treated as facts, and claims with nothing behind them. A small zero-dependency library for JavaScript and Python labels each value with where it came from and how much to trust it, and keeps the label attached through every derivation: a result built from a mock says so, and no later step can upgrade it.

One rule underneath all of it

Combining values can keep or lower their trust level, never raise it.

JavaScript · the same in Python
const base  = mark(1000, { source: "real", confidence: "high" });
const rate  = mark(1.25, { source: "mock", confidence: "low" });
const total = derive([base, rate], (a, r) => a * r);

total.derivedFromMock; // true   inherited from rate, and impossible to clear
total.confidence;      // 'low'  only as certain as the weakest input

mark puts the labels on a value (real, mock, inferred, fallback; confidence high down to none). derive runs your own function on labelled values and carries the labels through, keeping the weakest. The library never does the arithmetic and never changes a value; it only keeps the labels honest.

Who it's for

You probably want this if…

AI agents write or modify your code; if mocks, fixtures, fallbacks or synthetic values sit anywhere between an input and an output; or if your outputs are claims: a figure in a paper, a risk score, a forecast, a "safe to proceed". Common in agent-built systems, research code, data and ML pipelines, and inherited codebases.

If your app reads a trusted database and shows what it finds, you probably don't need the run-time layer; the fit map says so plainly.

Three routes

Install.

As a Claude Code plugin
/plugin marketplace add slopstopper/marketplace
/plugin install plumb-line@slopstopper
The library
npm install plumb-line-provenance
pip install plumb-line-provenance

Then run plumb-line-adopt. It looks at your repository and tells you which parts of plumb-line fit and what to run first. Updates arrive through /plugin. Zero dependencies. You can also copy primitives/js/ or primitives/python/ straight into your project.

In CI. Add the GitHub Action. On every pull request it runs the checks your .plumb-line/enforcement.json manifest names and writes one SARIF log, with no agent involved. Not using Claude? portable/README.md is the entry point without the plugin.

Already installed?

The repository is the documentation.

Write-ups

What shipped, with receipts.

One short piece per release, drafted from the shipped artifacts and passed through the same audit gate as the code. Machine-drafted, owner-edited, sources listed on every piece. This list is generated from the plumb-line repository.