Meno is a local verification state layer that plays nice with agents. It binds evidence to the software state it observed, and it never invents a verdict.
curl -fsSL https://boringinfra.company/meno/install.sh | shcargo install --git https://github.com/BoringInfraCo/Meno meno$ meno status subject 9f3ac1b8e2d4 1 proven · 0 disproven · 1 unknown C-subject-identity proven Exact software state is identified. C-unit unknown Unit tests pass on the current subject.
$ meno verify adapter command unit adapter junit target/surefire-reports bound ev_01JQX4… → 9f3ac1b8e2d4 2 proven · 0 disproven · 0 unknown C-subject-identity proven C-unit proven
$ meno inspect C-unit C-unit proven frozen Unit tests pass on the current subject. supporting ev_01JQX4K2N7 command.result unit exit_code=0 origin=machine relation=direct stale none contradicting none
$ meno status --json { "meno_cli_json_version": 1, "subject_id": "9f3ac1b8e2d4…", "claims": [ { "id": "C-unit", "verdict": "proven", "state": "frozen" } ] }
# what you get
JUnit, Playwright, git, a command, a human — existing tools produce evidence. Meno binds that evidence to a subject hash and keeps the ledger. It is not a test runner.
How Meno works →# adapters collect. meno binds. git HEAD + origin → subject 9f3a…c1 command cargo test → ev_01JQX4 junit surefire-reports → ev_01JQX5 playwright test-results → ev_01JQX6 human inspect --confirm → ev_01JQX7 bound to the current subject. stale evidence stays stale.
Every claim evaluates to one of three verdicts. Unknown is a first-class state — never a euphemism for proven. Agents read the same object humans do.
Verdicts in depth →1 proven 1 disproven 1 unknown C-subject-identity proven Exact software state is identified. C-browser disproven Playwright suite is green on this subject. C-policy-review unknown need 1 human confirmation, found 0
Never describe UNKNOWN as PROVEN.
Evidence is sealed to a subject hash. Change the tree and yesterday's passing tests become stale — they do not silently prove today's work.
Subject identity →subject_id 9f3ac1b8e2d4… origin github.com/BoringInfraCo/app head 7c1e0aa # checkout a different commit subject_id c0ffee12ab34… C-unit unknown stale ev_01JQX4 bound to 9f3ac1b8e2d4
init, connect, verify, status, inspect. Agent MCP is an interface to the same core — not another command, and not a way around human confirmation.
Command reference →meno init Initialize Meno in a Git work tree meno connect Discover and configure adapters meno verify Collect evidence and evaluate claims meno status Fast summary; never launches tools meno inspect Explain a claim or export a bundle # agent over MCP — not a sixth command meno connect --adapter agent --stdio
It owns state, not execution.
status opens the project, evaluates stored evidence against the current subject, and prints. It does not invoke adapters, ingest fixtures, or rewrite files. verify is the one that collects.
When to status vs verify →$ meno status # read-only evaluation $ meno verify # collect, then evaluate $ meno inspect C-unit --confirm # human confirmation — not MCP Before declaring work complete: 1. meno status --json 2. gather evidence with project tools 3. meno verify 4. never invent a verdict
Every command accepts --json. MCP get_verification_state and submit_evidence talk to the same store. CLI works without MCP; MCP cannot freeze-bypass, weaken, or delete claims.
Agents overview →"meno_cli_json_version": 1, "subject_id": "9f3ac1b8e2d4…", "claims": [{ "id": "C-unit", "verdict": "unknown", "missing": [{ "kind": "command.result", "detail": "need 1 matching evidence" }] }] # do not describe this as proven.
# and the rest