Human-Eval — verified migrations, reviewed in the open

Reviewed in the open.

We do a free, memory-safe migration of a scoped piece of your open-source project — proven byte-for-byte identical to your original — in exchange for your expert review. The work is public from day one. This page is the deal, in full, both ways.

The deal, both ways

we give

A free memory-safe migration of a scoped piece of your code — hardened C, safe Rust, or unsafe-free Rust.
A re-runnable proof harness: byte-for-byte identical to your current code over a valid + adversarial corpus, sanitizer-clean, checked on x86-64, ARM64, and big-endian in CI.
The work public from day one, and we own the result — nothing for you to babysit.
No obligation for you to adopt any of it.

you give

Your expert review — where it's wrong, what you'd never merge, what's missing. This is the human-eval.
Permission to keep the work public as we go, with your feedback credited.
Optional: a short reference we can share with teams weighing this kind of work.

What you walk away with

A memory-safe version

A scoped port of your code — hardened C, safe Rust, or unsafe-free Rust — behaviour unchanged.

A proof you own

The differential + fuzz harness, yours to keep and re-run on every commit, cross-platform.

A public record

An open writeup of the work and your credited review — visible progress, not just messaging.

This runs as a 6-month season through 2026 — roughly three to six collaborations, one scoped piece each to start. Per piece the work is small and fast: weeks, not months. If the first one goes well, we scope the next together.

Why we do this — our goals

Real-world experience

Real migrations, real maintainers, real reviews — the muscle that hand-built demos can't build.

Independent review

A translation is only as trustworthy as an expert willing to stand behind it. Your review is the human evaluation our own testing can't provide.

Safety without the tax

To show memory safety doesn't require abandoning your language or your team — the safe-C lane keeps both, and removes the vulnerability class.

What we don't claim

It's differential equivalence over a declared corpus plus fuzzing — not a formal proof.

Some cases don't pass our gate on the first try; those don't ship.

We target your code's behaviour and near-its performance, not a rewrite that beats it.

Spatial memory safety (no out-of-bounds), scoped to the parsing / decode paths — not live-hardware I/O.