Why Ordo
The hard part was never writing the code
An agent can produce a plausible implementation of almost anything. What it cannot reliably do is know where the change belongs, what it is allowed to affect, which states are valid, and what would count as finished — because in most codebases nobody wrote those down.
What the industry measured when it checked
The optimistic case is real and narrow. GitHub 2022 found 95 developers completing a bounded, automatically scored, greenfield task 55% faster with assistance. That result holds, for that kind of task.
Then the harder measurements arrived. METR (Becker, Rush, Barnes, Rein) 2025 put sixteen experienced maintainers on 246 real issues in repositories they knew well and found them 19% slower with AI available. The striking part is not the slowdown; it is that they could not perceive it. They forecast 24% faster beforehand and still believed they had been 20% faster afterwards.
At organisational scale, DORA / Google Cloud 2025 found AI adoption now correlating with higher delivery throughput and higher delivery instability at the same time — more change failures, more rework, longer recovery. The throughput problem got solved. The stability problem did not.
arXiv 2605.01160 2026 names the shape across more than ten thousand developers: 98% more pull requests, 91% longer review times, flat delivery. Industry analysis has a name for the missing term — a verification tax on code that reads as correct.
Put together: generation is cheap now, and everything downstream of generation is not. Reviewing, verifying, integrating and recovering from AI-written code is where the cost went. DORA's own explanation is that change volume has outrun the control systems meant to absorb it.
Why more tests do not fix it
The obvious response is to test harder. Two independent findings say that does not address this failure class.
METR 2025 took eighteen real tasks in two mature repositories and found agent solutions that passed the reference tests and still failed merge-readiness review — on testing, documentation, formatting, typing and general quality.
We found the same thing from the other direction. A fresh reviewer examined a build that had already passed a 90-test suite, a strict type check, a dependency audit, an architecture check and an adversarial self-review with mutation testing. It found five defects, and 0 of 5Independent-verification findings the builder's own checks had already caught had been caught by any of it. In a separate build, the test suite 2 + 1 + 1 + 0Defects, by the mechanism that found each.
A test suite checks what its author thought to assert. That is enormously valuable and it is not the same as checking whether the work is right.
| Mechanism | Refuses | Cannot refuse |
|---|---|---|
| Type and exhaustiveness checking | Unrepresentable states, unhandled cases, signature drift | Code that type-checks and does the wrong thing |
| Architecture and dependency checks | Layering violations, inverted dependencies | Correct layering around incorrect behaviour |
| Contract and boundary checks | Representation collapse at a declared boundary | Boundaries nobody declared |
| Behavioural tests | Behaviour the author thought to assert | A check that passes for the wrong reason |
| Integration against a real boundary | Present-but-inert implementations, wire-format mismatches | Conditions the integration environment never produces |
| Independent adversarial review | Declared-but-unreachable outcomes, vacuous assertions | Anything the reviewer also fails to imagine |
The specific failures this produces
Code that compiles, passes, and does nothing
A boundary arm exists, type-checks, satisfies the architecture check and the contract tests — and does no work. We removed one deliberately: 0 of 3Checks that objected to a deliberately removed boundary arm objected. Five targeted mechanisms were then built to close that class, and re-tested: 0 of 4Mechanical checks that caught a present-but-inert boundary arm caught it. Only a live integration test did, in every trial.
A rename that changes meaning in silence
When duration stopped meaning six-minute units and started meaning minutes, the compiler caught eight sites and around ~14Call sites where a rename silently changed meaning more passed the value as a bare positional integer. Identical source text, six times the duration, green build, passing tests. Two came out correct 2Values that survived the change correct by coincidence.
One fact, several copies, no agreement check
The one value a compiler protected had zero duplication. The two outside its reach were duplicated four times and twice, with nothing checking the copies agreed. A shared type does not fix this: the identical type produced three different wire behaviours depending on the call path, inside one process.
A declared outcome nothing can produce
A reconciliation result declared four outcomes and the code could construct three. Every caller handled a case that would never arrive, and believed it was covered. Ninety tests and a mutation-tested self-review did not find it.
What Ordo does instead
It moves the constraints out of convention, documentation and tribal knowledge, and into structures a machine can act on. State becomes a named thing that is stored rather than inferred. Change happens through declared transitions, so illegal actions are unavailable rather than defended against. A rule has one authority, so the copy that drifts does not exist. Verification is several mechanisms whose blind spots differ, because one mechanism has been measured to be insufficient.
arXiv 2605.01160 2026 reaches the same conclusion from the outside: under specification governance, the bottleneck on velocity moves from generation to specification clarity. Two independent builds of the same frozen requirements show that clarity is reachable — 58 / 58Acceptance criteria implemented and traced traced criterion by criterion, twice, with all nine open questions preserved rather than guessed past.
- 1Semantically complete state viewThe domain projects the smallest authoritative view in which no omitted fact could change legality, evidence requirements, coverage, capability applicability, obligations, policy, or transition outcome.
- 2EvidenceTyped evidence identifies what was observed, where it came from, when it was observed, and what it depends on.
- 3Scoped coverageEach contract-defined scope is Complete, Partial, or Unknown. Required non-Complete coverage refuses the decision before provider execution.
- 4Capabilities and obligationsHost-established semantic authority is supplied as capabilities; unresolved required work remains explicit as obligations.
- 5Legal choice spacePolicy, guards, state, evidence, coverage, capabilities, and obligations determine which outcomes are actually legal.
- 6Compute, bounded decide, refuse, or escalateDeterministic work stays deterministic. Judgment happens only inside the legal choice space. Missing prerequisites do not force an answer.
- 7Result, requested effects, and auditThe result carries the state identity and decision facts forward; external work is requested as data and observations are recorded for later verification.
Where we expected a result and did not get one
Three things this research programme believed, measured, and gave up. They stay published because a methodology that only reports its confirmations is not offering you evidence.
- That explicit domain types reduce the cost of propagating change. Tested with everything else held constant: no measurable difference on field renames, and no help from either type system on arithmetic business rules. The result →
- That making boundaries explicit reduces boundary work. It does not. 4.0, unchangedBoundary files per semantic decision, after hardening — measured three times, across two architectures, identically. It changed how the work was found, not how much of it there was.
- That a higher mechanical discovery rate means lower cost. In one paired trial the hardened condition scored 42.1% to 31.6%As-experienced mechanical discovery rate on discovery while spending less on search and repair. The two proxies moved in opposite directions on the same mission.