Local-first, by default
The work happens on your machine. Network access is a feature you opt into, not the condition for the software to function.
The standard
What every release has to clear.
Most software pages tell you what the product does. This one tells you what must be true before it is allowed to reach you, because that is the part which determines whether the rest of it is worth anything.
No error without a way out of it
This is the rule we care about most. Software refuses people constantly and then abandons them there. Something failed, or you are not allowed, and that is the end of the message. No cause, no next step, nothing you can act on. It is everywhere and we are sick of it. Nothing we ship is permitted to stop you without telling you what happened, why it happened, and what you can do about it yourself. If we cannot write that third part, the feature is not finished and it does not ship.
A bug becomes a failing test before it becomes a fix
Nothing is repaired from a description. The reported behaviour is reproduced as a test that fails, the fix makes it pass, and that test stays in the suite permanently so the same defect cannot return quietly.
Every screen a person can reach gets a journey test
Not just unit tests on functions nobody clicks. If you can see it or click it, an end to end test walks the path. Every reachable state must offer its next action, or it counts as a dead end and fails.
A design change is global, or it is not done
When a shared element changes, whether that is the header, a control, a template or an email, every surface that renders it changes with it. We enumerate the surfaces by searching the codebase, fix the shared renderer, and add a parity test that fails the build if any surface drifts.
The gate is fail-closed
A verification script runs the whole suite, type checks, builds, hashes the artifacts, and exits non-zero on anything unresolved. There is no override flag. If it does not exit zero, the release does not exist.
Claims carry numbers
“Tested” is not a status. A release is described with counts, exit codes and hashes, or it is not described as finished. A red gate reported honestly is a valid outcome; a confident sentence with nothing behind it is treated as a defect in its own right.
Installed, or it did not ship
Source that compiles is not a release. The build must reach a real machine, pass a health check, and match its published hash. Anything short of that is labelled source-only, in plain words, on the page.
The refusal contract
Every error carries its own way out
When our software stops you, the message has to do three things. If we cannot write the third one, the feature is not finished.
What happened
In plain words. Not a code, not a stack trace, not "an error occurred".
Why it happened
The actual cause, including when the cause is a limit we imposed.
What you can do now
A concrete next step you can take yourself. If the only honest answer is that you cannot fix it, then it says so and tells you who can.
Principles
What we will not trade away
No silent telemetry
We do not collect usage analytics from your desktop by default. If a product ever needs diagnostics it asks, shows you what it would send, and works fine if you decline.
Honest state, always
Every product page states whether it is shipped, awaiting signing, in beta or unbuilt, and it lists its known limits. You should never discover a constraint after paying for it.
Small, sharp tools
Each application does one job properly. We would rather ship four narrow tools than one that does eleven things adequately.
Build receipts
What we publish beside a download
When releases open, every version page carries the output of the gate that let it out: the suite counts, the verification exit code, the artifact size, its SHA-256, and the signature you can check it against. Not a badge. The actual numbers.
The point is not that you will check them. The point is that we cannot quietly skip a step when the receipt is published next to the button.
// published with every release release ........... 1.2.1 gate .............. exit 0 suite ............. 21/21 passing artifact .......... BeyondGpuManager-1.2.1-x64.exe size .............. 118.4 MB sha256 ............ a3f1… (full hash on the release page) signature ......... verified
The values above illustrate the format. Real receipts appear on release pages once signing is in place and the first artifact is published.